FEDERAL  BUREAU  OF  INVESTIGATION 
FOI/PA 

DELETED  PAGE  INFORMATION  SHEET 
FOI/PA#  1353814-0 

Total  Deleted  Page(s)  = 86 
Page  5 Referral/Consult; 

Page  6 Referral/Consult; 

Page  7 Ref erra  1 /Consul t ; 

Page  8 Ref  erra  1 /Consul  t ; 

Page  9 Referral/Consult; 

Page  10  Referral/Consult; 

Page  11  Ref  err  al /Consul  t ; 

Page  12  Ref  err  al /Consul  t ; 

Page  13  Ref  err  al /Consul  t ; 

Page  14  Referral/Consult; 

Page  15  Referral/Consult; 

Page  3 6 Duplicate ; 

Page  37  Duplicate; 

Page  38  Duplicate; 

Page  39  Duplicate; 

Page  53  Referral/Consult; 

Page  54  Ref  err  al /Consul  t ; 

Page  55  Ref  err  al /Consul  t ; 

Page  56  Referral/Consult; 

Page  57  Refer ral /Consult ; 

Page  58  Ref  err  al /Consul  t ; 

Page  59  Ref  err  al /Consul  t ; 

Page  60  Referral/Consult; 

Page  61  Referral/Consult; 

Page  62  Referral/Consult; 

Page  63  Ref  err  al /Consul  t ; 

Page  64  Ref  err  al /Consul  t ; 

Page  65  Referral/Consult; 

Page  66  Referral/Consult; 

Page  67  Ref  err  al /Consul  t ; 

Page  68  Ref  err  al /Consul  t ; 

Page  69  Referral/Consult; 

Page  70  Referral/Consult; 

Page  71  Referral/Consult; 

Page  72  Ref  err  al /Consul  t ; 

Page  73  Ref  err  al /Consul  t ; 

Page  74  Refer  ral /Consult ; 

Page  75  Refer  ral /Consult ; 

Page  76  Ref  err  al /Consul  t ; 

Page  77  Ref  err  al /Consul  t ; 

Page  78  Ref  err  al /Consul  t ; 

Page  79  Refer  ral /Consult ; 

Page  80  Referral/Consult; 

Page  81  Ref  err  al  /Consul  t ; 

Page  8 2 Referral /Consult; 

Page  83  Referral/Consult; 

Page  84  Referral/Consult; 

Page  8 5 Ref  err  al /Consul  t ; 


Page 

86 

Page 

87 

Page 

88 

Page 

89 

Page 

90 

Page 

135 

Page 

136 

Page 

137 

Page 

138 

Page 

146 

Page 

147 

Page 

148 

Page 

149 

Page 

206 

Page 

207 

Page 

208 

Page 

212 

Page 

213 

Page 

214 

Page 

215 

Page 

216 

Page 

236 

Page 

237 

Page 

251 

Page 

252 

Page 

253 

Page 

257 

Page 

258 

Page 

259 

Page 

260 

Page 

261 

Page 

284 

Page 

285 

Page 

286 

Page 

287 

Page 

288 

Page 

291 

Page 

292 

Ref err al /Consul t ; 
Referral /Consult ; 
Referral /Consult ; 
Ref err al /Consul t ; 
Ref err al /Consul t ; 
Ref erral /Consul t ; 
Referral /Consult ; 
Referral /Consult ; 
Ref erral /Consul t ; 
Ref erral /Consul t ; 
Referral /Consult ; 
Referral /Consult ; 
Ref erral /Consul t ; 
Ref erral /Consul t ; 
Ref erral /Consul t ; 
Referral /Consult ; 
Referral /Consult ; 
Ref erral /Consul t ; 
Ref erral /Consul t ; 
Referral /Consult ; 
Referral /Consult ; 
Referral /Consult ; 
Ref erral /Consul t ; 
Ref erral /Consul t ; 
Referral /Consult ; 
Referral /Consult ; 
Ref erral /Consul t ; 
Ref erral /Consul t ; 
Referral /Consult ; 
Referral /Consult ; 
Referral /Consult ; 
Ref erral /Consul t ; 
Ref erral /Consul t ; 
Referral /Consult ; 
Referral /Consult ; 
Ref erral /Consul t ; 
Duplicate ; 
Duplicate ; 


xxxxxxxxxxxxxxxxxxxxxxxx 

X Deleted  Page{s)  X 
X No  Duplication  Fee  X 
X For  this  Page  X 
XXXXXXXXXXXXXXXXXXXXXXXX 


FD-1057  (Rev.  5-8-10) 


T//NOPQrai 


OpficiaLRecoro 


Al  ^notini  b*4n  wnfi*tf  t>v  4 

cirtfad  mrtflfnniw 


FEDERAL  BUREAU  OF  INVESTIGATION 


Electronio  Communtcation 


Title : [U//F0UQ)  Opening  of  Full  Investigation  on 

a Sensitive  Investigative  Matter  (SIM) 


Date;  07/10/2015 


CC: 


TP I lU^D. 

CLASSIFIED  BY:  NSICC-  J57JS5T54 
KZASOl-J:  1 . 4 iC) 


From: 


COUNTERINTELLIGENCE 

D5-CD4 


DECLASSII^l^  CdJ:  12-3i-2D4D 
DATE : iO-27-2D16 


Contact; 


Approved  By:  | J 

SC  KABLE  CHARLES  H IV 
A/ DAD  David  W Archey 
AD  COLEMAN  RANDALL  C 


Drafted  By: 


Case  ID 


#: 


i 

MISHANDLING  OF  CLASSIFIED; 

UNKNOWN  SUBJECT  OR  COUNTRY; 

SENSITIVE  INVESTIGATIVE  MATTER  (SIM) 


he 

hlC 


hS 

hlC 


he 

hlC 


hi 

b3 

b7E 


DOCUMENT  RESTRICTED  TO  CASE  PARTICIPANTS 

This  document  contains  information  that  is  restricted  to  case  participants* 


Synopsis:'  ' ) FBIHQ,  Counterespionage  Section,  is  opening  a full 

investigation  based  on  specific  articulated  facts  provided  by  an  811 
referral  from  the  Inspector  General  .of  the  Intelligence  Community, 
dated  .July  6,  2015  regarding  the  potential  compromise  of  classified 
information. 


(Ui 

l1  * ' 

231 

Full  Investigation  Initiated:  07/10/2015 


SgfefiET//HOrORM 


Title:  (U//TOTCr)  Opening  of  Full  Investigation  on  a Sensitive 

Investigative  Matter  (SIM) 

Re:  I 07/10/2015 


Enclosure (s) : Enclosed  are  the  following  items; 

1.  (U/ / rOUO)  Referral  documents  received  from  ICIG 

Details: 

’Uj  FBIHQ,  Counterespionage  Section,  is  opening  a full  invest! 

gation  based  on  specific  articulated  facts  provided  by  an  811  referral 
from  the  Inspector  General  of  the  Intelligence  Community  (ICIG),  dated 
July  6,  2015  regarding  the  potential  compromise  of  classified 
information. 

(U/ /FQUO)  The  purpose  of  this  investigation  is  to  detect,  obtain 
information  about,  and  protect  against  federal  crimes  or  threats  to  the 
national  security.  The  initiation  of  this  Full  Investigation  is  based, 
as  per  AGG-Dom  II, B. 3 and  DIOG  Section  7.5,  on  activity  constituting ^a 
federal  crime  or  a threat  to  the  national  security  has  or  may  have 
occurred,  is  or  may  be  occurring,  or  will  or  may  occur  and  the 
investigation  may  obtain  information  relating  to  the  activity  or  the 
involvement  or  role  of  an  individual,  group,  or  organization  in  such 
activity . 

;U;  ICIG  referral  provided  a sample  unclassified  e-mail 

than  allegedly  contains  information  at  a classified  and  SCI  level. 
According  to  the  ICIG,  this  e-mail  was  part  of  a larger  trove  of  other 
unclassified  e-mails  they  were  reviewing  during  their  own 
investigation , 

The  following  documentation  was  provided  by  the  ICIG  and 
will  be  kept  in  the  lA  section  of  the  case  file. 


1)  811  referral  letter  from  the  ICIG  dated  July  6,  2015  regarding 
Potential  Compromise  of  Classified  Information. 

2)  Letter  from  the  ICIG  dated  June  19,  2015  regarding  Update  to  IC 
IG  support  to  State  Department  IG. 

3)  Letter  from  the  ICIG  dated  June  25,  2015  regarding  Classified 
Material  on  Personal  Storage  Devices. 

4)  E-mail  dated  April  10,  2011  with  example  of  potential  inclusion 
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Title : [U/ /POUO)  Opening  of  Full  Investigation  on  a Sensitive 

Investigative  Matter  (SIM) 

Re:  I I 07/10/2015 
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Of  classified  information  contained  in  an  unclassified  e-mail. 

5)  Letter  from  Williams  & Connolly  LLP  dated  June  24,  2015  regarding 
preservation  efforts  related  to  e-mails. 

(gyyJsJF)  Due  to  the  extremely  sensitive  nature  of  this 
investigation  and  the  damage  its  disclosure  could  cause,  the  case  will 
be  designated  as  a prohibited  investigation  in  accordance  with  the 
Counterintelligence  Division  Policy  Implementation  Guide.  Author 
requests  Assistant  Director  concurrence  to  maintain  the  identified  case 
as  prohibited. 

This  investigation  is  also  designated  a Sensitive 
Investigative  Matter  (SIM)  due  to  a connection  to  a current  public 
official,  political  appointee  or  candidate  as  defined  in  Section 
10.1.2.2.2  of  the  DIOG. 


Additionally,  an  Assistant  .Director  exemption  for 
uploading  to  Sentinel  is  requested.  Since  the  ICIG  referral  alleges 
classified  SCI  material  may  have  been  compromised,  all  investigative 
work  will  be  conducted  on  SCION.  As  documents  to  the  case  file  are 
added,  a placeholder  will  be  entered  into  Sentinel  and  a serial  number 
assigned  to  the  document.  Electronic  copies  of  the  case  serials  will 
be  stored  on  SCION.  The  physical  case  file  documents  will  be  stored  in 

a currently  certified  SCIF. 
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U.  S.  Department  of  Justice 


Federal  Bureau  of  Investigation 


In  Reply,  Please  Refer  to  Washington  DC,  20535 

File  No.  July  13, 2015 


(U)  QPEWIMiS  LHM  FOR  FULL  INVESTIGATION  OW  USPER 


(U)  Subject (s)  Name:  UNKNOWN  SUBJECT 

{U)  Preliminary  Investigation 

(O)  X Full  Investigation 

. Single  subject 

X Multi-subject 
Enterprise 

Foreign  intelligence  collection 


CLASSIFIED  3Y:  NSICG  J37JS5T54 
3EASDH;  1.4  (C; 

DECLASSIFl,’  aJ  12-31-2040 
DATE-  10-27-2016 


ALL  INFOEatATIOH  CCHTAIHEE 
HEREIN  IS  UNC.LASSIFIEE  EXCEPT 
'ifflERE  SHai-a-I  OTHERVilSE 


(U)  Investigation  initiated  by:  Field  Office  or  X FBIHQ 

(O)  FBIHQ/DOJ  notice  via  LHM  required  (if  yes  to  any  below) : 

X A,  full  on  USPER 

X B.  SIM  (PI  or  full) 

C.  enterprise  investigation 

1 D.  foreign  intelligence  case 

(U)  I . Purpose  of  the  Investigation : 

Check  the  appropriate  purpose  for  which  the  investigation  is  being 
initiated,  as  per  AGG-Dora  II.B.l  and  DIOG  ''6.2  and  7.2; 

Class! fieSl-Sin  C5^WT5b90 

Derived  FroinJ>Bt^SIC  dated  20130301 

Declass ify-On:  2 04t)-&:213 


Page  1 of  4 


This  document  contains  neither  recoirimendations  nor  conclusions  of  the  FBI . It  is  the 
property  of  the  FBI' and  is  loaned,  to  your  agency;  it  and  its  contents  are  not  to  be 
distributed  outside  your  agency. 


MISHANDLING  OF  CLASSIFIED; 
UNKNOWN  SUBJECT  OR  COUNTRY; 
SENSITIVE  INVESTIGATIVE  MATTER 


X A.  To  detect,  obtain  information  about,  or  prevent  or 

protect  against  federal  crimes  or  threats  to  the  national 
security. 

B,  To  collect  foreign  intelligence.  (Full  investigations 

only) 


(U)  II.  Predication  for  the  Investigation: 

Appropriate  circumstances:  Check  the  appropriate  circumstance (s ) 
on  which  the  initiation  of  the  Preliminary  investigation  or  Full 
Investigation  is  based,  as  per  AGG-Dom  II. B. 3 and  DIOG  Sections  6.5 
and  7.5; 

X A.  (U)  An  activity  constituting  a federal  crime  or  a threat 
to  the  national  security  has  or  may  have  occurred,  is  or  may  be 
occurring,  or  will  or  may  occur  and  the  investigation  may  obtain 
information  relating  to  the  activity  or  the  involvement  or  role  of  an 
individual,  group,  or  organization  in  such  activity; 


B-  (U)  An  individual,  group,  organization,  entity, 

information,  property,  or  activity  is  or  may  be  a target  of  attack, 
victimization,  acquisition,  infiltration,  or  recruitment  in  connection 
with  criminal  activity  in  violation  of  federal  law  or  a threat  to  the 
national  security  and  the  investigation  may  obtain  information  that 
would  help  to  protect  against  such  activity  or  threat. 


__  C.  (U)  The  investigation  may  obtain  foreign  intelligence  that 
is  responsive  to  a Positive  Foreign  Intelligence  Requirement,  as 
defined  in  DIOG  Section  7.4.C.  [Full  investigations  only] 

vUl  (53^7^0^)  FBIHQ,  Counterespionage  Section,  is  opening  a full 
investigation  based  on  specific  articulated  facts  provided  by  an  811 
referral  from  the  Inspector  General  of  the  Intelligence  Community. 
(ICIG) , dated  July  6,  2015  regarding  the  potential  compromise  of 
classified  information. 

(U/ /-FOU©)  The  purpose  of  this  investigation  is  to  detect,  obtain 
information  about,  and  protect  against  federal  crimes  or  threats  to 
the  national  security.  The  initiation  of  this  Full  Investigation  is 
based,  as  per  AGG-Dom  II. B. 3 and  DIOG  Section  7.5,  on  activity 
constituting  a federal  crime  or  a threat  to  the  national  security  has 
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or  may  have  occurred,  is  or  may  be  occurring,  or  will  or  may  occur  and 
the  investigation  may  obtain  information  relating  to  the  activity  or 
the  involvement  or  role  of  an  individual , group,  or  organization  in 
such  activity. 

The  ICIG  referral  provided  a sample  unclassified  e-mail 
that  allegedly  contains  information  at  a classified  and  SCI  level* 
According  to  the  ICIG,  this  e-mail  was  part  of  a larger  trove  of  other 
unclassified  e-mails  they  were  reviewing  during  their  own 
investigation- 

illi  The  following  documentation  were  provided  by  the  ICIG  and 

will  be  kept  in  the  lA  section  of  the  case  file* 

1)  811  referral  letter  from  the  ICIG  dated  July  6,  2015  regarding 
Potential  Compromise  of  Classified  Information* 

2)  Letter  from  the  ICIG  dated  June  19,  2015  regarding  Update  to 
IC  IG  support  ^ to  State  Department  IG . 

3)  Letter  from  the  ICIG  dated  June  25,  2015  regarding  Classified 
Material  on  Personal  Storage  Devices  * 

4 ) E-mail  dated  April  10 , 2011  with  example  of  potential 
inclusion  of  classified  information  contained  in  an  unclassified 
e-mail. 

5)  Letter  from  Williams  & Connolly  LLP  dated  June  24,  2015 
regarding  preservation  efforts  related  to  e-mails. 
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(U)  IV-  Certification: 


The  case  agent  and  all  approving  personnel  certify  tha t : 

^ A-  An  authorized  purpose  and  adequate  predication  exist 

for  initiating  the  preliminary  or  full  investigations ; 

^ ^ - The  investigation  is  not  based  solely  on  the  exercise 

of  First  Amendment  activities  or  race,  religion, 
national  origin  or  ethnicity  of  the  subject;  and 

^ C-  The  investigation  is  an  appropriate  use  of  personnel 
and  financial  resources. 


(U/ /-TOUQ)  The  point  of  contact  for  this  investigation  is 


Assistant  Section  Chief 


telephone  nuinber|  | 
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ALL  INFORilATIOM  COIJTAIHEC 
HiKEIN  IS  UlTCLASSiriEC  EXCEPT 
ViHERE  SHCWT7  OTHER^WISE 


■T//«orowff 


CLASSIFIED  EY:  NSICG  J37JS5T34 
REASON:  1.4  (C) 

DECLASSIFY'  ai:  12-31-2040 
DATE:  10-27-2016 


U.S-  Department  of  Justice 


Federal  Bureau  of  Investigation 


In  Reply,  Please  Refer  to 
File  No. 

21  July  2015 

To:  Sally  Quilliati  Yates 

Deputy  Attorney  General 
Department  of  Justice 


From:  Mark  F,  Giuliano 

Deputy  Director 

Federal  Bureau  of  Investigation 


Subject: 

MISHANDLING  of  CLASSIFIED; 

UNKNOWN  SUBJECT  OR  COUNTRY; 

SENSITIVE  INVESTIGATIVE  MATTER  (SIM) 

(5?7r^)  On  13  July  2015  and  20  July  2015,  I verbally  advised 
you  of  a Section  811(c)  referral  from  the  Inspector  General  of  the 
Intelligence  Community  received  by  the  FBI  on  06  July  2015.  The 
referral  addressed  the  mishandling  of  classified-  information  on  the 
personal  e-mail  account  and  electronic  media  of  a former  high-level 
S}  US  Government  official.  On  10  July  2015.  the  FBI  initiated  a full 

investigation,  |.n  response  to  the  referral. 

Two  copies  of  the  opening  letterhead  memorandum  for  the  investigation 
are  attached  for  the  information  of  the  Department  of  Justice. 

(U/ /FQUQ)  The  point  of  contact  for  this  investigation  is 
Assistant  Director  Randall  C . Coleman,  Counterintelligence  Division, 
telephone  number 
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Mark  F.  Giuliano 
FBI,  Deputy  Director 


Derived  Sources 

De  cl^.seiTYorr-^^^.y  2 3 1 


07/21/2015 


S.LL  IlfrGS^J.ffi.TIOl'T  COHTAIHED 

HEREIN  13  UHCLASSiriED 

CATE  10-27"201€  BY  J27JS5T34  H3ICC 


please  have  the  DD  sign  these  two  documents.  One  will  be  provided  the  DAG/DOJ  and  the  other 


copy  will  be  placed  in  our  records  here  at  FBIHQ. 
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U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C.  20535-0001 


ALL  Il'R’ORi.LAriOH  COTTAIIEE 

HSailM  IS  Ul-ICLASSiriED 

DATZ  1 □“27-20 16  BY  J37JSDT34  W3ICG 


July  27,  2015 
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Re;  Request  for  Preservation  of  Records 


Dear 


be 

b7C 


Pursuant  to  Title  18,  United  States  Code  Section  2703(f),  this  letter  is  a formal  request  for 
the  preservation  of  all  records  and  other  evidence  in  your  possession  regarding  the|  | 


Jpending 


Y ou  are  hereby  requested  to  pi  trv  ^ a<eiMi)ed  below  currently  in  your 

possession,  including  records  stored  a that  includes  the  complete 

record,  and  records  that  may  come  int^Hri  date  of  acknowledgment  of  this 

request  until  receipt  of  a legal  court  or'i^^  not  to  disclose  the  existence 

of  this  request  to  the  subscriber  or  any  o-;  necessary  to  comply  with  this 

request,  as  the  FBI's  investigation  mayfca  , tfflii^^^^Hpe  of  disclosure.  You  are  also 

requested  not  to  close  the  account  of  f oer,  ^^^^^^sted  to  do  so  by  the  subscriber. 

If  compliance  with  this  request  may  result  in  a permanent  or  temporary  termination  of  service 
to  the  accounts  described  below,  or  otherwise  alert  the  subscriber  or  user  of  these  account  as 
to  your  actions  to  preserve  the  referenced  files  and  records,  please  contact  Special  Agent 

as  soon  as  possible  and  before  taking  any  such  actions. 


This  preservation  request  applies  to  the  following  records  and  evidence: 


A.  All  stored  electronic  communications  and  other  files  reflecting  communications  to 
or  from  the  requested  account, 

B.  All  records  and  other  evidence  relating  to  the  subscriber(s),  customer(s),  account 
holder(s),  or  other  entity (ies)  associated  with  the  requested  account  including, 
without  limitation,  subscriber  names,  user  names,  screen  names  or  other  identities, 
mailing  addresses,  residential  addresses,  business  addresses,  e-mail  addresses  and 
other  contact  information,  telephone  numbers  or  other  subscriber  number  or 
identity,  billing  records,  information  about  the  length  of  service  and  the  types  of 
services  the  subscriber  or  customer  utilized,  and  any  other  identifying 


be 

b7C 

b7E 


be 
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information,  whether  such  records  or  other  evidence  are  in  electronic  or  other 
form;  and 

C.  All  connection  logs  and  records  of  user  activity  for  the  requested  account, 
including: 

1 . Connection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  Method  of  connection  (e.g,,  telnet,  ftp,  http); 

4.  Data  transfer  volume; 

5.  User  name  associated  with  the  connection  and  other  connection 
information,  including  the  Internet  Protocol  address  of  the  source  of  the 
connection; 

6.  Telephone  caller  identification  records;  and 

7.  Connection  information  for  other  computers  to  which  the  user  of  the 
above-referenced  accounts  connected,  by  any  means,  during  the 
connection  period,  including  the  destination  IP  address,  connection  time 
and  date,  disconnect  time  and  date,  method  of  connection  to  the 
destination  computer,  the  identities  (account  and  screen  names)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such 
connection  information  relates,  and  all  other  information  related  to  the 
connection  from  ISP  or  its  subsidiaries. 

D.  Any  other  records  and  other  evidence  relating  to  the  requested  account.  Such 
records  and  other  evidence  include,  without  limitation,  correspondence  and  other 
records  of  contact  by  any  person  or  entity  about  the  above-referenced  account,  the 
content  and  connection  logs  associated  with  or  relating  to  postings, 
communications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 


If  you  have  any  questions  regarding  this  request,  please  direct  all  inquiries  to 
Special  Agent  ~|fyho  can  be  reached  at 


Sincerely, 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 


hS 
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U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C.  20535-0001 


July  28,  2015 

b7E 


Re:  Request  for  Preservation  of  Records 

Dear  Sir  or  Madam: 

Pursuant  to  Title  18,  United  States  Code  Section  2703(f),  this  letter  is  a formal  request  for 

the  preservation  of  all  records  and  other  evidence  in  your  possession  regarding  the 

[pending  further  legal  process. 

1.1 

2. 

3. 

4. 

5. 


You  are  hereby  requested  to  preserve  the  records  described  below  currently  in  your 
possession,  including  records  stored  on  backup  media,  in  a form  that  includes  the  complete 
record,  and  records  that  may  come  into  your  possession  from  the  date  of  acknowledgment  of  this 
request  until  receipt  of  a legal  court  order.  You  are  also  requested  not  to  disclose  the  existence 
of  this  request  to  the  subscriber  or  any  other  person,  other  than  as  necessary  to  comply  with  this 
request,  as  the  FBI's  investigation  may  be  jeopardized  by  this  type  of  disclosure.  You  are  also 
requested  not  to  close  the  account  of  the  subscriber,  unless  requested  to  do  so  by  the  subscriber. 
If  compliance  with  this  request  may  result  in  a permanent  or  temporary  termination  of  service 
to  the  accounts  described  below,  or  otherwise  alert  the  subscriber  or  user  of  these  accounts  as 
to  your  actions  to  preserve  the  referenced  files  and  records,  please  contact  Special  Agent 

as  soon  as  possible  and  before  taking  any  such  actions. 

This  preservation  request  applies  to  the  following  records  and  evidence: 

A.  All  stored  electronic  communications  and  other  files  reflecting  communications  to 
or  from  the  requested  account. 
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B.  All  records  and  other  evidence  relating  to  the  subscriber(s),  customer(s),  account 
holder(s),  or  other  entity(ies)  associated  with  the  requested  account  including, 
without  limitation,  subscriber  names,  user  names,  screen  names  or  other  identities, 
mailing  addresses,  residential  addresses,  business  addresses,  e-mail  addresses  and 
other  contact  information,  telephone  numbers  or  other  subscriber  number  or 
identity,  billing  records,  information  about  the  length  of  service  and  the  types  of 
services  the  subscriber  or  customer  utilized,  and  any  other  identifying 
information,  whether  such  records  or  other  evidence  are  in  electronic  or  other 
form;  and 

C.  All  connection  logs  and  records  of  user  activity  for  the  requested  account, 
including: 

1 . Connection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  Method  of  connection  (e.g.,  telnet,  ftp,  http); 

4.  Data  transfer  volume; 

5.  User  name  associated  with  the  connection  and  other  connection 
information,  including  the  Internet  Protocol  address  of  the  source  of  the 
connection; 

6.  Telephone  caller  identification  records;  and 

7.  Connection  information  for  other  computers  to  which  the  user  of  the 
above-referenced  accounts  connected,  by  any  means,  during  the 
connection  period,  including  the  destination  IP  address,  connection  time 
and  date,  disconnect  time  and  date,  method  of  connection  to  the 
destination  computer,  the  identities  (account  and  screen  names)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such 
connection  information  relates,  and  all  other  information  related  to  the 
connection  from  ISP  or  its  subsidiaries. 

D.  Any  other  records  and  other  evidence  relating  to  the  requested  account  Such 
records  and  other  evidence  include,  without  limitation,  correspondence  and  other 
records  of  contact  by  any  person  or  entity  about  the  above-referenced  account,  the 
content  and  connection  logs  associated  with  or  relating  to  postings, 
communications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 


If  you  have  any  questions  regarding  this  request,  please  direct  all  inquiries  to 


Special  Agent 


who  can  be  reached  at 
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Sincerely, 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 


ALL  I^^^OPMAT^Ot•T  CQtfTAIWED 


U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C.  20535-0001 


July  27,  2015 


Re:  Request  for  Preservation  of  Records 


Dear 


Pursuant  to  Title  1 8,  United  States  Code  Section  2703(f),  this  letter  is  a formal  request  for 
the  preservation  of  all  records  and  other  evidence  in  your  possession  regarding  the  | 

pending  further  legal  process. 


You  are  hereby  requested  to  preserve  the  records  described  below  currently  in  your 
possession,  including  records  stored  on  backup  media,  in  a form  that  includes  the  complete 
record,  and  records  that  may  come  into  your  possession  from  the  date  of  acknowledgment  of  this 
request  until  receipt  of  a legal  court  order.  You  are  also  requested  not  to  disclose  the  existence 
of  this  request  to  the  subscriber  or  any  other  person,  other  than  as  necessary  to  comply  with  this 
request,  as  the  FBI's  investigation  may  be  jeopardized  by  this  type  of  disclosure.  You  are  also 
requested  not  to  close  the  account  of  the  subscriber,  unless  requested  to  do  so  by  the  subscriber. 
If  compliance  with  this  request  may  result  in  a permanent  or  temporary  termination  of  service 
to  the  accounts  described  below,  or  otherwise  alert  the  subscriber  or  user  of  these  accounts  as 
to  your  actions  to  preserve  the  referenced  files  and  records,  please  contact  Special  Agent 

as  soon  as  possible  and  before  taking  any  such  actions. 


This  preservation  request  applies  to  the  following  records  and  evidence: 

A.  All  stored  electronic  communications  and  other  files  reflecting  communications  to 
or  from  the  requested  account. 

B.  All  records  and  other  evidence  relating  to  the  subscriber(s),  customer(s),  account 
hoIder(s),  or  other  entity(ies)  associated  with  the  requested  account  including, 
without  limitation,  subscriber  names,  user  names,  screen  names  or  other  identities, 
mailing  addresses,  residential  addresses,  business  addresses,  e-mail  address^  and 
other  contact  information,  telephone  numbers  or  other  subscriber  number  or 
identity,  billing  records,  information  about  the  length  of  service  and  the  types  of 
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services  the  subscriber  or  customer  utilized,  and  any  other  identifying 
information,  whether  such  records  or  other  evidence  are  in  electronic  or  other 
form;  and 

C.  All  connection  logs  and  records  of  user  activity  for  the  requested  account, 
including: 

1 . Connection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  Method  of  connection  (e.g.,  telnet,  ftp,  http); 

4.  Data  transfer  volume; 

5.  User  name  associated  with  the  connection  and  other  connection 
information,  including  the  Internet  Protocol  address  of  the  source  of  the 
connection; 

6 . T elephone  caller  identification  records ; and 

7.  Connection  information  for  other  computers  to  which  the  user  of  the 
above-referenced  accounts  connected,  by  any  means,  during  the 
connection  period,  including  the  destination  IP  address,  connection  time 
and  date,  disconnect  time  and  date,  method  of  connection  to  the 
destination  computer,  the  identities  (account  and  screen  names)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such 
connection  information  relates,  and  all  other  information  related  to  the 
connection  from  ISP  or  its  subsidiaries. 

D.  Any  other  records  and  other  evidence  relating  to  the  requested  account.  Such 
records  and  other  evidence  include,  without  limitation,  correspondence  and  other 
records  of  contact  by  any  person  or  entity  about  the  above-referenced  account,  the 
content  and  connection  logs  associated  with  or  relating  to  postings, 
communications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 


If  you  have  any  questions  regarding  this  request,  please  direct  all  inquiries  to 
Special  Agenj  who  can  be  reached  at  | 
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Sincerely, 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 


# 

U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C,  20535-0001 


July  27,  2015 


Re:  Request  for  Preservation  of  Records 


Dean 


Pursuant  to  Title  18,  United  States  Code  Section  2703(f),  this  letter  is  a fonnal  request  for 
the  preservation  of  all  records  and  other  evidence  in  your  possession  regarding  the| 

pending  further  legal  process. 


You  are  hereby  requested  to  preserve  the  records  described  below  currently  in  your 
possession,  including  records  stored  on  backup  media,  in  a form  that  includes  the  complete 
record,  and  records  that  may  come  into  your  possession  from  the  date  of  acknowledgment  of  this 
request  until  receipt  of  a legal  court  order.  You  are  also  requested  not  to  disclose  the  existence 
of  this  request  to  the  subscriber  or  any  other  person,  other  than  as  necessary  to  comply  with  this 
request,  as  the  FBI's  investigation  may  be  jeopardized  by  this  type  of  disclosure.  You  are  also 
requested  not  to  close  the  account  of  the  subscriber,  unless  requested  to  do  so  by  the  subscriber. 
If  compliance  with  this  request  may  result  in  a permanent  or  temporary  termination  of  service 
to  the  accounts  described  below,  or  otherwise  alert  the  subscriber  or  user  of  these  accounts  as 
to  your  actions  to  preserve  the  referenced files  and  records,  please  contact  Special  Agent 

soon  as  possible  and  before  taking  any  such  actions. 

This  preservation  request  applies  to  the  following  records  and  evidence: 

A.  All  stored  electronic  communications  and  other  files  reflecting  communications  to 
or  from  the  requested  account. 

B.  All  records  and  other  evidence  relating  to  the  subscriber(s),  customer(s),  account 
holder(s),  or  other  entity (ies)  associated  with  the  requested  account  including, 
without  limitation,  subscriber  names,  user  names,  screen  names  or  other  identities, 
mailing  addresses,  residential  addresses,  business  addresses,  e-mail  addresses  and 
other  contact  information,  telephone  numbers  or  other  subscriber  number  or 
identity,  billing  records,  information  about  the  length  of  service  and  the  types  of 
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services  the  subscriber  or  customer  utilized,  and  any  other  identifying 
information,  whether  such  records  or  other  evidence  are  in  electronic  or  other 
form;  and 

C.  All  connection  logs  and  records  of  user  activity  for  the  requested  account, 
including: 

1 . Connection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  Method  of  connection  (e.g.,  telnet,  ftp,  http); 

4.  Data  transfer  volume; 

5.  User  name  associated  with  the  connection  and  other  connection 
information,  including  the  Internet  Protocol  address  of  the  source  of  the 
connection;  - 

6.  Telephone  caller  identification  records;  and 

7.  Connection  information  for  other  computers  to  which  the  user  of  the 
above-referenced  accounts  connected,  by  any  means,  during  the 
connection  period,  including  the  destination  IP  address,  connection  time 
and  date,  disconnect  time  and  date,  method  of  connection  to  the 
destination  computer,  the  identities  (account  and  screen  names)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such 
connection  information  relates,  and  all  other  information  related  to  the 
connection  frorn  ISP  or  its  subsidiaries, 

D,  Any  other  records  and  other  evidence  relating  to  the  requested  account.  Such 
records  and  other  evidence  include,  without  limitation,  correspondence  and  other 
records  of  contact  by  any  person  or  entity  about  the  above-referenced  account,  the 
content  and  connection  logs  associated  with  or  relating  to  postings, 
communications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 


If  yon  have  any  questions  regarding  this  request,  please  direct  all  inquiries  to 


Special  Agent] 


who  can  be  reached  at] 


Sincerely, 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 
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July  24, 2015 


VIA  ELECTRONIC  TRANSMISSION 

The  Honorable  James  B,  Comey,  Jr, 

Director 

Federal  Bureau  of  Investigation 
935  Pennsylvania  Avenue,  NW 
Washington,  D.C.  20535 

Dear  Director  Comey: 

The  Inspector  Genera!  of  the  Intelligence  Community  (IC)  and  the  Inspector  General  of 
the  State  Department  (State  OIG)  recently  notified  the:  FBI  and  several  Intelligence  Community 
agencies  of  a compromise  of  national  security  information  in  connection  with  Hillary  Clinton’s 
use  of  a non -govern mental  email  server  while  Secretary  of  State.  Specifically,  in  a sample  of  40 
of  Secretary  Clinton’s  emails  IC  identified  four  containing  classified  IC-derived  information. 
These  recent  revelations  raise  important  questions  about  the  role  the  Federal  Bureau  of 
Investigation  (FBI)  has  taken  and  will  continue  to  take  in  this  matter.  In  addition,  a notification 
from  the  IC  indicates  that  these  classified  emails  existed  on  a thumb  drive  and  may  exist  on  a 
server.  According  to  a briefing  provided  today  by  the  IC  and  State  OIGs,  former  Secretary 
Clinton’s  persona!  attorney,  David  Kendall,  was  in  possession  of  the  thumb  drive  at  the  time  of 
the  notice  to  the  FBI  and  other  IC  components.  This  raises  very  serious  questions  and  concerns 
if  a private  citizen  is  somehow  retaining  classified  information. 

Accordingly,  please  explain  whether  Mr.  Kendall  had  the  requisite  security  clearance  and 
authorization  to  be  the  custodian  of  classified  national  security  information.  If  not,  please 
explain  what  steps  the  FBI  has  taken  or  plans  to  take  to  secure  and  prevent  further  dissemination 
of  the  classified  information  contained  on  the  thumb  drive.  In  addition,  what  steps  are  being 
taken  to  hold  anyone  in  this  matter  accountable  for  unauthorized  possession  of  classified 
material? 

If  you  have  any  questions,  contact  Josh  Flynn- Brown  of  my  Committee  Staff  at  (202)  224- 

5225. 

Sincerely, 

Charles  E,  Grassley 
Chairman 

Committee  on  the  Judiciary 


We  ask  that  this  be  an  uncIassilSed  report,  and  that  a classified  annex  be  provided  if 
necessary.  Thank  you  for  yotEr  time,  and  we  look  forward  to  working  with  you  oil  this 
important  matter  of  national  Purity. 


Sincerely, 


Chairman  Bob  Corker 

Senate  Foreign  Relations  Committee 


Chairman  Richard  Burr 

Senate  Select  Committee  on  Intelligence 


Chairman  ffloiwohnson 
Senate  Homeland  Security  and 
Governmental  Affairs  Committee 
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■fHEY  GOWDY,  SOUTH  CAROUNA 
Ch^urman 


lYNN  WESTMORELAND,  GEORGIA 
JIMJoRDAN,  OHIO 
PETER  ROSKAM.  ILLINOIS 
MIKE  POMPEO,  KANSAS 

Martha  roby,  Alabama 

SUSAN  W.  BROOKS,  INDIANA 
PHILIP  G.  KIKO,  Staff  Oirf=ctor 
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Confiresijf  of  tfje  ®nited  States 


^ousc  of  SRcprcssmtatibcfi 

Select  Committee  on  Benghazi 

1036  Long  worth  House  Office  Building 
Washington,  O.C.  20515-6090 
(202)  226^7100 
http:/^benghazj.  house^gov 


ELIJAH  6,  CUMMINGS.  MARYLAND 
Ranking  MiHonrrY  Member 

ADAM  SMITH,  WASHINGTON 
ADAM  B.  SCHIFF,  CALIFORNIA 
LINDA  T-  SANCHEZ,  CALIFORNIA 
TAMMY  DUCKWORTH,  ILLINOIS 

114™  CONGRESS 

SUSANNE  SACHSIWAN  GROOMS,  Minohitv 
Staff  OiREtJTon 


July  22,  2015 


The  Honorable  James  B.  Comey 
Director 

Federal  Bureau  of  Investigation 
935  Pennsylvania  Avenue,  NW 
Washington,  DC  20535 


Dear  Director  Comey; 

TTie  House  of  Representatives  charged  and  empowered  the  Select  Committee  on 
Ben^^i  to  review  the  events  before,  during,  and  after  the  2012  attacks  in  Benghazi,  Libya  and 
specified  related  matters.  During  the  pendency  of  our  investigation,  the  Committee  has 
discovered  facts  suggesting  the  existence  of  issues  of  significant  legislative  and  oversi^t 
concern.  'I  now  understand  a formal  referral  has  been  made  to  the  Federal  Bureau  of 

Investigation  by  impartial  officials  within  the  Executive  Branch  regarding  potential  investigative 
issues  flowing  from  some  of  these  facts.  ■ “ 

While  die  Committee’s  work  will  continue  for  legislative,  oversight,  and  reform 
pu^oses.  It  is  important  the  Bureau  also  immediately  consider  whether  a thorough,  independent 
and  nonpartisan  review  of  the  matters  referred  to  it,  as  well  as  issues  attendant  thereto  is 
w^anted  This  is  necessary  to  ensure  the  laws  ^e  enforced  fairly,  evenly,  and  impartiallv 
whoever  fte  relevant  facts  may  lead.  The  Bureau  is  in  the  best  and  most  appropriate  position  to 
evaluate  the  complete  range  of  counterintelligence  and  public  integrity  equities  that  may  be 
iinplicat^.  Only  the  Bureau  can  accomplish  this  in  a way  that  ensures  public  confidence  in  a 
tair,  timely,  and  exhaustive  investigation  of  these  matters.  And  the  Bureau  is  uniquely  well 
suited  to  ensure  this  is  accomplished  free  of  any  external  factors  save  the  facts  applied 
assiduously  to  the  law  and  devoid  of  either  real  or  perceived  political  influence. 


The  principles  at  bar  are  particularly  important  with  respect  to  counterintelligence 
^uities  and  the  handling  retention,  and  storage  of  classified  information.  The  Department  of 
Justice  has  recently  applied  a consistent  standard  of  aggressive  and  evenhanded  investigation  in 
cases  ran^ng  from  Edward  Snowden  to  David  Petraeus  in  order  to  unambiguously  deter  future 
mishandling  and  disclosure.  I understand  significant  concerns  have  been  referred  to  the  Bureau 
m this  area  based  on  the  objective  assessment  of  an  interagency  review  that  included  consultation 
with  the  officials  responsible  for  determining  what  information  is  classified.  The  facts 
underlying  this  referral  potentially  implicate  the  same  important  interests  the  Department  has 
steadfastly  sought  to  protect  in  the  past. 


Similarly,  the  Department  has  thorou^ly  investigated  matters  relating  to  the  handling  of 
evidence  relevant  to  potential  or  ongoing  investigations  and  the  accuracy  of  representations  made 
to  Congress  even  in  sensitive  national  security  cases.  While  I expect  the  Committee  will 
continue  to  explore  relevant  facts  and  issues  within  its  charter,  the  Committee  is  willing  to 
provide  access  to  any  information  currently  obtained  during  the  course  of  our  investigation  that 
may  inform  and  instruct  matters  raised  in  the  referral. 


You  have  spoken  in  the  past  about  ‘hhe  reservoir  of  credibility  and  trust  that  is  the 
Department  of  Justice”  and  you  have  stated  “I  am  a huge  believer  in  the  rule  of  law  but  I also 
bdieve  that  no  one  in  this  country  is  beyond  the  law.”  I could  not  agree  With  you  more  Your 
work  IS  ultimately  judged,  as  mine  once  was,  by  the  blindfolded  woman  holding  nothing  but  a set 
of  scales  and  a sword.  The  evenhanded  application  of  the  law  and  the  dogged,  impartial  pursuit 
of  the  facts  are  the  hdlmarks  of  justice. 

1 hope  you  will  carefolly  consider  these  matters.  They  are  outside  the  purview  of  what 
our  Committee  has  been  asked  to  do,  but  clearly  within  the  four  comers  of  what  you  have  been 
asked  to  do. 


cc:  The  Honorable  John  Boehner 

Speaker  of  the  House 

The  Honorable  Eiijali  Cummings 
Ranking  Member 
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U.S.  Department  of  Justice 


Federal  Bureau  of  Investigation 

Washington,  D.C.  20535*0001 


ALL  IWF051.3LTICH  Ca-ITAIlffiD 
BEKJEIH  13  UWCLAS3IFIEC 


July  27,  2015 

Steve  Linick 
Inspector  General 
U.S.  Department  of  State 
Room  8100,  SA-3 
2201  C Street,  N.W. 

Washington,  DC  20520-0308 

Re:  Request  for  Preservation  of  Records 

Pursuant  to  Title  18,  United  States  Code  Section  2703(1),  this  letter  is  a formal  request  for 
the  preservation  of  all  records  and  other  evidence  in  your  possession  regarding  the  domain 
account  @clintonemail.com  and  the  @sta te.gov  email  accounts  associated  with  the  following 
U.S.  Department  of  State  employees,  pending  further  legal  process. 


b6 

b7C 

bVE 


You  are  hereby  requested  to  preserve  the  records  described  below  currently  in  your 
possession,  including  records  stored  on  backup  media,  in  a form  that  includes  the  complete 
record,  and  records  that  may  come  into  your  possession  from  the  date  of  acknowledgment  of  this 
request  until  receipt  of  a legal  court  order.  You  are  also  requested  not  to  disclose  the  existence 


of  this  request,  other  than  as  necessary  to  comply  with  this  request,  as  the  FBI’s  investigation 
may  be  jeopardized  by  this  type  of  disclosure. 

This  preservation  request  applies  to  the  following  records  and  evidence: 

A.  All  stored  electronic  communications  and  other  files  reflecting  communications  to 
or  fi'om  the  requested  account. 

B.  The  contents  of  any  communication  or  file  stored  by  or  for  the  accounts  and  any 
associated  accounts,  and  any  information  associated  with  those  communications 
or  files,  such  as  the  source  and  destination  emails  addresses  and  IP  addresses. 

C.  All  connection  logs  and  records  of  user  activity  for  the  requested  account, 
including: 

1 . Connection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  Method  of  connection  (e.g.,  telnet,  ftp,  http); 

4.  Data  transfer  volume; 

5.  User  name  associated  with  the  connection  and  other  coimection 
information,  including  the  Internet  Protocol  address  of  the  source  of  the 
connection; 

6.  Telephone  caller  identification  records;  and 

7.  Connection  information  for  other  computers  to  which  the  user  of  the 
above-referenced  accounts  connected,  by  any  means,  during  the 
connection  period,  including  the  destination  IP  address,  connection  time 
and  date,  disconnect  time  and  date,  method  of  connection  to  the 
destination  computer,  the  identities  (account  and  screen  names)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such 
connection  information  relates,  and  all  other  information  related  to  the 
connection  fi'om  ISP  or  its  subsidiaries. 

D.  Any  other  records  and  other  evidence  relating  to  the  requested  account.  Such 
records  and  other  evidence  include,  without  limitation,  correspondence  and  other 
records  of  contact  by  any  person  or  entity  about  the  above-referenced  account,  the 
content  and  connection  logs  associated  with  or  relating  to  postings, 
communications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 


If  you  have  any  questions  regarding  this  reques 
Special  Agent  who  can  be  reached  at 


please  direct  all  inquiries  to 


Sincerely, 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 
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U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C.  20535-0001 


July  31,  2015 

David  Kendall,  Esq. 

Katherine  Turner,  Esq. 

Law  Offices  of  Williams  & Connolly  LLP 
725  Twelfth  Street,  N.W. 

Washington,  D.C.  20005 

Re:  Request  for  Preservation  of  Records 

This  letter  is  a formal  request  for  the  preservation  of  all  records  and  other  evidence  in 
your  possession,  or  in  the  possession  of  your  client,  Hillary  Clinton,  regarding  the  domain 
account  @clintonemail.coiti,  pending  ftirther  legal  process. 

You  are  hereby  requested  to  preserve  the  records  described  below  currently  in  your 
possession,  or  in  the  possession  of  your  client,  including  records  stored  on  backup  media,  in  a 
form  that  includes  the  complete  record,  and  records  that  may  come  into  your  possession  from  the 
date  of  acknowledgment  of  this  request  until  receipt  of  a legal  court  order.  You  are  also 
requested  not  to  disclose  the  existence  of  this  request,  other  than  as  necessary  to  comply  with  this 
request,  as  the  FBI's  investigation  may  be  jeopardized  by  this  type  of  disclosure. 

This  preservation  request  applies  to  the  following  records  and  evidence: 

A.  All  stored  electronic  communications  and  other  files  reflecting  communications  to 
or  from  the  requested  domain  account. 

B.  All  servers,  computers,  thumbdrives,  hard  drives,  smartphones,  or  any  other 
digital  storage  devices  in  your  possession  or  in  the  possession  of  your  client, 
which  may  contain  communications  to  or  from  the  requested  domain  account. 

C.  All  business  records  and  other  evidence  relating  to  the  establishment  of  the 
domain  referenced  above,  including  subscriber(s),  customer(s),  account 
holder(s),  or  other  entity(ies)  associated  with  the  requested  account  including, 
without  limitation,  subscriber  names,  user  names,  screen  names  or  other  identities, 
mailing  addresses,  residential  addresses,  business  addresses,  e-mail  addresses  and 
other  contact  information,  telephone  numbers  or  other  subscriber  number  or 
identity,  billing  records,  infomiation  about  the  length  of  service  and  the  types  of 
services  the  subscriber  or  customer  utilized,  and  any  other  identifying 
infomiation,  whether  such  records  or  other  evidence  are  in  electronic  or  other 
form;  and 


D.  All  connection  logs  and  records  of  user  activity  for  the  requested  account, 
including: 

1 . Connection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  Method  of  connection  (e.g.,  telnet,  ftp,  http); 

4.  Data  transfer  volume; 

5.  User  name  associated  with  the  connection  and  other  connection 
information,  including  the  Internet  Protocol  address  of  the  source  of  the 
connection; 

6.  Telephone  caller  identification  records;  and 

7.  Coimection  information  for  other  computers  to  which  the  user  of  the 
above-referenced  accounts  connected,  by  any  means,  during  the 
connection  period,  including  the  destination  IP  address,  connection  time 
and  date,  disconnect  time  and  date,  method  of  connection  to  the 
destination  computer,  the  identities  (account  and  screen  names)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such 
coimection  information  relates,  and  all  other  information  related  to  the 
connection  fi"om  ISP  or  its  subsidiaries. 

E.  Any  other  business  records  and  other  evidence  relating  to  the  requested  account. 
Such  records  and  other  evidence  include,  without  limitation,  correspondence  and 
other  records  of  contact  by  any  person  or  entity  about  the  above-referenced 
account,  the  content  and  connection  logs  associated  with  or  relating  to  postings, 
communications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 


Special  Agen^ 


If  you  have  any  questions  regarding  this  request,  please  direct  all  inquiries  to 


who  can  be  reached  an 


Sincerely, 


Charles  H.Kable  IV 
Section  Chief 

Counterintelligence  Division 


hS 

hlC 


U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C.  20535-0001 


ALL  IHFOISLATIOH  COITTAirJEE 
IS  IJl-IGLASSIFIED 

DATE  ID” 31-20 16  BY  J37J85TS4  K3ICG 


July  29,  2015 

John  Kerry 
Secretary  of  State 
U.S.  Department  of  State 
Washington,  DC  20520 


Re;  Request  for  Preservation  of  Records 

Pursuant  to  Title  18,  United  States  Code  Section  2703(f),  this  letter  is  a formal  request  for 
the  preservation  of  all  records  and  other  evidence  in  your  possession  regarding  the  domain 
account  @clintonemail.com  and  the  @state.gov  email  accounts  associated  with  the  following 
U.S.  Department  of  State  employees,  pending  further  legal  process. 


1. 

2. 

3. 

4. 

5. 

6. 

7. 

8. 

9. 

10, 

11. 

12. 
13, 
14 

15. 

16, 

17. 

18. 
19. 


You  are  hereby  requested  to  preserve  the  records  described  below  currently  in  your 
possession,  including  records  stored  on  backup  media,  in  a form  that  includes  the  complete 
record,  and  records  that  may  come  into  your  possession  from  the  date  of  acknowledgment  of  this 
request  until  receipt  of  a legal  court  order.  You  are  also  requested  not  to  disclose  the  existence 


of  this  request,  other  than  as  necessary  to  comply  with  this  request,  as  tiie  FBI's  investigation 
may  be  jeopardized  by  this  type  of  disclosure. 

This  preservation  request  applies  to  the  following  records  and  evidence: 

A.  All  stored  electronic  communications  and  other  files  reflecting  communications  to 
or  from  the  requested  account. 

B.  The  contents  of  any  communication  or  file  stored  by  or  for  the  accounts  and  any 
associated  accounts,  and  any  information  associated  with  those  communications 
or  files,  such  as  the  source  and  destination  emails  addresses  and  IP  addresses. 

C.  All  connection  logs  and  records  of  user  activity  for  the  requested  account, 
including: 

1 . Connection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  Method  of  connection  (e.g.,  telnet,  ftp,  http); 

4.  Data  transfer  volume; 

5.  User  name  associated  with  the  connection  and  other  connection 
information,  including  the  Internet  Protocol  address  of  the  source  of  the 
connection; 

6.  Telephone  caller  identification  records;  and 

7.  Connection  information  for  other  computers  to  which  the  user  of  the 
above-referenced  accounts  connected,  by  any  means,  during-the 
connection  period,  including  the  destination  IP  address,  comiccirdn  time 
and  date,  disconnect  time  and  date,  method  of  connectibn  tQ4hC. 
destination  computer,  the  identities  (account  and  screen  nsmers)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such 
connection  information  relates,  and  all  other  information  related  to  the 
connection  from  ISP  or  its  subsidiaries. 

D.  Any  other  records  and  other  evidence  relating  to  the  requested  account.  Such 
records  and  other  evidence  include,  without  limitation,  correspondence  and  other 
records  of  contact  by  any  person  or  entity  about  the  above-referenced  account,  the 
content  and  connection  togs  associated  with  or  relating  to  postings, 
communications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 

If  you  have  any  questions  regarding  this  request,  please  direct  all  inquiries  to 
Special  Agent!  [who  can  be  reached  at 

Sincerely. 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 
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FEDERAL  BUREAU  OF  INVESTIGATION 
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On  07/29/2015,  at  approximately  3 p.m..  Special  Agents 
served  a preservation  letter  addressed  to  Steve  A.  Linick.  I 


Investigation  on  07/29/2015 at  Washington^  DC 


Date  dictated N/A 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency:  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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On  07/29/2015j  at  approximately  3:28  Special  Agents] 

~~|served  a preservation  letter  addressed  to  John  Kerry,  Secretary  of  State,  U.S,  Department  of  State 

Executive  Assistant  for  Patrick  F.  Kennedy,  Under  Secretary  for 


Management,  Department  of  State. 

The  preservation  letter  was  served  at  U.S.  Department  of  State’s  Visitor  Center,  2201  C Street. 


NW,  Washington,  DC  20520. 

I 1 


provided  her  contact  phone  number  as  | | 


Investigation  on  07/29/2015 

File#  J L 


at Washington,  DC 

' Date  dictated  N/A 


ALL  IHFORiiATint'l  COHTAIHED 

HEKEIH  IS  UWCLASSiriEC 

DATE  10~31-'2015  3Y  J37JS5T34  HSICC 


From: 

Sent: 

To: 

Subject: 

Attachments: 


Friday.  July  31. 2015  8:21  AM 

I IfCD)  {FBI} ^ 

Preservation  Confirmation  H | 

1212643.tif;  Notice  - Addressing  of  Legal  Demands  .pdf 


he 

hic 

b7E 


Helld 


FBI,  Washington  DC , 


Hhas  received  your  preservation  request(s)  on  the  account  name(s)  listed  in  the  attached  faxP 
preserve  the  requested  account  data,  if  any  account  data  exists,  for  a period  of  90  days  from  30  July  201  S,| 
you  whether  any  data  exists  for  the  accounts  that  are  subject  to  your  preservation  request. 


[will 

Jcannot  advise 
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Your  preservation  record  number  is| 
any  preserved  data. 


Be  sure  to  refer  to  this  record  number  when  requesting  the  disclosure  of 


18  U.S,C,  2703(0(2)  of  the  Electronic  Communications  Privacy  Act  permits  a single  90  extension  for  each  preservation  request.  If  we 
do  not  receive  a preservation  extension  request  within  90  days  from  the  date  of  this  preservation  letter,  the  preserved  data  will  be 
destroyed.  Also,  please  be  aware  that  preservations  are  merely  one  time  snapshots  of  the  account  on  the  date  the  information  is 
preserved.  Preservations  are  not  snapshots  made  each  day  during  the  90  day  preservation  timeframe. 

If  you  send  an  extension  to  your  preservation  request,  please  indicate  that  your  request  is  an  extension  so  we  may  quickly  identify  the 
account  that  you  preserved  and  ensure  that  the  initial  data  preservation  is  maintained. 


Finally,  when  you  submit  your  legal  request  for  us  to  disclose  the  preserved  data,  please  provide  the  preservation  request  number 
along  with  the  date  of  the  original  preservation  so  that]  may  retrieve  all  relevant  stored  data> 


Thank  you, 


b7E 
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ALL  FSI  IMrORllATICM'  CONTAIIJEE 

HEKEIH  IS  Ul'ICLASSiriED 

CATE  ID-Sl-COie  BY  J37JS5T34  NSICC 


UNDER  SECRETARY  OF  STATE 
FOR  MANAGEMENT 
WASHINGTON 

JUL  30  2015 


Dear  Mr.  Kable: 

This  letter  is  to  acknowledge  your  letter  of  July  29,  2015,  to  Secretary  Kerry 
in  which  you  made  a formal  request  for  the  preservation  of  all  records  or  other 
evidence  in  the  Department  of  State’s  position  regarding  the  domain  account 
@clintonemail.com  and  the  @state.gov  email  accounts  for  19  former  and  current 
personnel. 

The  preservation  request  has  been  tasked  to  the  appropriate  Department  of 
State  personnel  for  execution. 


My  point  of  contact  for  your  request  is  my  Executive  Assistant] 
Iwho  can  be  reached  at 


Regards, 


Patrick  F.  Kennedy 


Mr.  Charles  H.  Kable  IV, 

Section  Chief, 

Counterintelligence  Division, 

U.S.  Department  of  Justice, 

Federal  Bureau  of  Investigation, 

Washington,  D.C.  20535-0001. 
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Mr.  Charles  H.  Kable  IV,  Section  Chief 
Counterintelligence  Division 
U.S.  Department  of  Justice 
Fpripral  Bureau  of  Investigation 
c/o  MrJ 

Washington,  D.C.  20535-0001 


The  United  States  of  America-Official  Business 
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FEDERAL  BUREAU  OF  INVESTIGATION 
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Event  Title : 


Colleoted  Item  Log 


Date:  08/06/2015 


Approved  By: 


Drafted  By: 


Case  ID  # : 


1 

{S/y4H^ 

MISHANDLING  OF  CLASSIFIED; 
UNKNOWN  SUBJECT  OR  COUNTRY; 
SENSITIVE  INVESTIGATIVE  MATTER 


(SIM) 
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Collected  From:  (U)  Katherine  Turner,  Esq 
Williams  & Connolly,  LLP 
725  12th  Street,  NW 
Washington 

Receipt  Given? : Wo 

Holding  Office:  WASHINGTON  FIELD 

Details;  No  Details  Provided 

Item  Type  Description 


t/Zhoforh 


This  document  comains  neither  recommendations  nor  conclusions  of  the  FBJ.  it  is  the  propem  of  the  FBI  and  is  loaned  to  your  agency;  it  and  its 
contents  are  not  to  be  distributed  outside  your  agency. 


^S1 


Title : 
Re : r 


08/06/2015 


hi 
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IB  Digital  (U)  1 Lexar  micron  16  GB  Black  & Silver  Thumbdrive  - 

LJDTT166-000-1001  DA  (Original) 

ILexar  Micron  8 GB  Green  and  White 
LJDTT8GB-000-117AU (Copy  1} 

1 Kingston  8GB  Silver  DT  SE9  {Copy  2 ) 

Collected  On:  Q8/Q6/2Q15 

Seizing  Individual : | | 

Collected  By: 

Location  Area : NA 
Specific  Location : NA 

Device  Type:  USB  Micro  Storage  Device  (thumb  drive) 
Number  of  Devices  Collected:  3 

IB  Digital  (U)  Lenovo  Think  Pad  T420  PB-YC912  12/03 

Collected  On:  08/06/2015 

Seizing  Individual r I | 

Collected  By:  | 

Location  Area:  NA 
Specific  Location:  NA 

Device  Type : USB  Micro  Storage  Device  (thumb  drive) 
Number  of  Devices  Collected:  1 
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DATE  1CI““31“2016  BY  J37JS5TS4  N3ICG 


U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C.  20535-0001 


August  5,  2015 

John  Keny 
Secretary  of  State 
U.S.  State  Department 
2201  C Street,  NW 
Washington,  DC  20520 


Re:  Request  for  Preservation  of  Records 

Pursuant  to  Title  18,  United  States  Code  Section  2703(f),  this  letter  is  a formal  request  for 
the  preservation  of  all  records  and  other  evidence  in  your  possession  regarding  the  @state.gov 
email  account  associated  with  Bryan  Pagliano,  pending  further  legal  process. 

You  are  hereby  requested  to  preserve  the  records  described  below  currently  in  your 
possession,  including  records  stored  on  backup  media,  in  a form  that  includes  the  complete 
record,  and  records  that  may  come  into  your  possession  from  the  date  of  acknowledgment  of  this 
request  until  receipt  of  a legal  court  order.  You  are  also  requested  not  to  disclose  the  existence 
of  this  request,  other  than  as  necessary  to  comply  with  this  request,  as  the  FBI's  investigation 
may  be  jeopardized  by  this  tsqie  of  disclosure. 

This  preservation  request  applies  to  the  following  records  and  evidence: 

A.  All  stored  electronic  communications  and  other  files  reflecting  communications  to 
or  from  the  requested  account. 

B.  The  contents  of  any  communication  or  file  stored  by  or  for  the  accounts  and  any 
associated  accounts,  and  any  information  associated  with  those  communications 
or  files,  such  as  the  source  and  destination  emails  addresses  and  IP  addresses. 

C.  All  connection  logs  and  records  of  user  activity  for  the  requested  account, 
including: 

1 . Connection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  Method  of  connection  (e.g.,  telnet,  ftp,  http); 

4.  Data  transfer  volume; 


5 . User  name  associated  with  the  connection  and  other  connection 
information,  including  the  Internet  Protocol  address  of  the  source  of  the 
connection; 

6.  Telephone  caller  identification  records;  and 

7.  Connection  information  for  other  computers  to  which  the  user  of  the 
above-referenced  accounts  connected,  by  any  means,  during  the 
connection  period,  including  the  destination  IP  address,  connection  time 
and  date,  disconnect  time  and  date,  method  of  connection  to  the 
destination  computer,  the  identities  (account  and  screen  names)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such 
connection  information  relates,  and  all  other  information  related  to  the 
connection  from  ISP  or  its  subsidiaries. 

D,  Any  other  records  and  other  evidence  relating  to  the  requested  account.  Such 

records  and  other  evidence  include,  without  limitation,  correspondence  and  other 
records  of  contact  by  any  person  or  entity  about  the  above-referenced  account,  the 
content  and  connection  logs  associated  with  or  relating  to  postings, 
communications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 


If  you  have  any  questions  regarding  this  request,  please  direct  all  inquiries  to 


Special  Ageni 


who  can  be  reached  at 


Sincerely, 


Charles  H.  Kable  IV 
Section  Chief 

Connterintelligence  Division 
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b7C 


FD-302a  (Rev.  10-6-95) 


-1- 


ALL  IHFORifATIOaj  COl-TTAIHiE 

SEKEIH  IS  Ul'TCLASSIFIEB 

DATE  10--31~201G  BY  J37J35T34  KSK 


FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  08/03/201 5 


On  August  3,  2015, 


Records 


Management  Division,  Records-  Information  and  Dissemination  Section, 
Winchester,  Virginia  provided  the  enclosed  internal  email 
communications  referencing  the  FBI's  classification  of  a November  18 . 


in 


2012  State  Department  email.  The  enclosure  was  provided  by 
support  of  statements  made  during  a July  30,  2015  FBI  interview  and 

documents  items  discussed  at  that  time.  The  enclosure  has  an  overall 
classification  of  SECRET/ /NOFORN. 


b6 

b7C 


Investigation  on  08/03 /20J  5 


File# 


at Wajihington.  D.C. 

Date  dictated  N/A 


b3 

b7E 


By  Sd 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


b6 

b7C 


DECLASSIFIED  BY:  l^SICG  JS7JS5T94 
□M  10““3:“201-S 


NF)(FE^) 


From: 

Sent: 

To: 

Subject: 


RMD)  (FBI) 


Monday.  Auausi:  03.  201 5 2:00  PM 
I l(NF)(FBI);[ 


Emails  — OECnET//HOronN 


SentinelCaseld:  TRANSITORY  RECORD 


](LA)(FBI) 


hS 

hlC 


Classification:  SECgE^ftZ^^f}- 

ClassY^i^d  By:  jr3j;^8T32 

Derived  I dated  20130301 

Declassi&rOiii  50X1-HUM' 


TRANSITORY  RECORD 


I b6 

b7C 

Attached  are  the  emails  I preserved.  The  last  one  probably  isn't  responsive,  but  you  don't  get  very  many  like  it. 

For  the  three  emails  in  which  there  was  no  classified  FBI  information  and  we  did  not  require  any  changes,  I'll  forward 
them  shortly.  Do  want  the  email  chain  as  well  for  them? 


■B 

State  Dept 
Emails.pdf 


Classification ; SEC 


1 


CECLASSiriEC  BY:  HSICG  J37J35T34 
□I'l  10~31”201t 


b6 

b7C 


From: 

Sent: 

To: 

Cc: 

Subject: 


IRMD)  (FBI)  ■ 

imo^da^AlDnlT06W5T2Wp^ 

ICTD)fFBn 

[RMD)(FBI);  JUPINA,  MICHELLE  A {RMD)(FBl):  NEAGLE.  LOUISE  M 

(RMD)(FBI) 

State  [Department  Emails  --FOIA  Coordination  — SECRET 


Importance:  High 

SentinelCaseld:  TRANSITORY  RECORD 


Classification: 


ClassTri?e<l_^:  J23J98^ 

Derived  dated  20120629 

Oe  c 1 a s s i fjit-Otrr2  oToil 


TRANSITORY  RECORD 


b6 

b7C 


Attached  is  an  email  forwarded  to  us  by  State  Oept.  for  coordination.  The  email  concerns  Benghazi  It  is  from  former 
Sec,  Clinton's  emails.  They've  asked  for  us  to  finish  our  review  by  COB  tomorrow,  Coutd  you  highlight  any  classified,  LES 
information?  Tm  at  HQ  today,  f classified  this  email  out  of  caution. 

■ffi 

FBI  H-0003.pdf 


Thanks, 


Classification: 


cos739aoa  - 

Work.pdf 


b6 

b7C 


DECLASSIFISD  BY:  KSICG  J37J85T34 
□IJ  11--07-201S 


Subject:  FW:  State  Department  Emails  — FOIA  Coordination  —SECRET 

Importance:  High 

SentinelCaseld:  TRANSITORY  RECORD 


C 1 a s sisf  i ca  t i on  j/S  EC  RET 

Classifie^X^:  J23J98T32 
Derived^omK^I  NSIC,  dated  20120629 
Decl^-^ify  On:  2<i401231 

TRANSITORY  RECORD 


As  we  discussed,  attached  is  the  email  for  review. 


Sent:  Monday,  April  06,  2015  2:37  PM 
To:|  tCTDKFBI) 

Cc:|  l(RMD)  (FBI);  JUPINA,  MICHELLE  A (RMD)(F8I);  NEAGLE,  LOUISE  M {RMD)(FBI) 

Subject;  State  Department  Emails  -*FOIA  Coordination  — SECRET 
Importance;  High 


b6 

b7C 


b6 

b7C 


Clas^d  ^icat  ion  : S^RET 

Class  if  J23J98T32 

Derived  NSIC,  dated  20120629 

Declas^dTiy  On?^^2^^01231 


TRANSITORY  RECORD 

b6 
b7' 

Attached  is  an  email  forwarded  to  us  by  State  Dept,  for  coordination.  The  email  concerns  Benghazi,  It  is  from  former 
Sec,  Ciinton's  emails.  They've  asked  for  us  to  finish  our  review  by  COB  tomorrow*  Could  you  highlight  any  classified,  LES 
information?  Tm  at  HQ  today,  I classified  this  email  out  of  caution* 


1 


C05739808 

Work.pdf 


FBI  H-0003.pdf 


Thanks, 


Classification : i CRgT 


Classification:  S :t 


b6 

b7C 


DSC-LASSIFIED  EY:  NSICC 
OM  11-07-201S 


J37085T94 


From: 

Sent: 

To: 

Cc: 

Subject: 


JCTD)(FB1):  JUPINA,  MICHELLE  A (RMD)(FBl[ 


J(RMD)(FBI);  NEAGLE,  LOUISE  M (RMD)(FBI) 

::  State  Department  Emails  -FOIA  Coordination  --- 


OECRCT 


SentinelCaseld:  TRANSITORY  RECORD 


b6 

b7C 


I 1 

Thanks!  State  emailed  me  and  said  they  have  55,000  pages  to  review  for  our  equities. 


From: 


Sent:  MdfflaaWA'D'rii 


To:j 

Cc: 


(CTt)){FBI) 
agtSfSSiRiyii 


b6 

b7C 


RMD^  fFBn 

](CTD){FBI);  JUPINA,  MICHELLE  A {RMD)(FBI)£ 


LOUISE  M (RMDXFBI) 

Subject:  RE:  State  Department  Emails  --FOIA  Coordination  — SECRET 


(RMD)  (FBI);  NEAGLE, 


TRANSITORY  RECORD 


b6 

b7C 

~|is  working  on  this  as  we  speak,  if  all  goes  as  planned  we  should  be  able  to  get  this  out  by  noon  tomorrow. 

He  is  going  to  have  it  packaged  for  me  to  run  by  the  front  office  in  the  morning. 

Respectfully, 


1 


From^ KRMD)  (FBI) 

Sent;  Monday,  April  06.  2015  3:55  PM 
To:  I IfCTDWBn 

Cc:^  bD)(FBI);  JUPINA,  MICHELLE  A (RMD)(F8I)J 

LoJlSE  M (RM0)(FS1) 

Subject:  FWr  State  Department  Emails  --FOIA  Coordination  — 
Importance:  High 


](RMD)  (FBI);  NEAGLE, 


Sent;  Monday,  April  06,  2015  2:37  PM 
ToJ  IfCTDlfFSn 

Cc:|  |(RMD)  (FBI);  JUPINA,  MICHELLE  A (RMD){FBI);  NEAGLE,  LOUISE  M (RMD)(F8I) 

Subject:  State  Departnrient  Emails  --FOIA  Coordination  — SCCRE-^ 

Importance:  High 


b6 

b7C 


2 


From: 

Sent: 

To: 

Cc: 

Subject: 


IrMD)  (FBI) 


ALL  IMFORI.LATI™  COMTAIl’IEE 

HZKZIN  IS  Ul^CLASSIFIEB 

DATE  11-07-2016  BY  J37J35T34  IJSICC 


I iRMDi  (FBI) 

IM/gaiSgggaWAm^08!IBQi1i5«.Q:59.AMi 
tCTDlfFBI) 

IfRMDl  (FBI) 

State  Department  Emails  -FOIA  Coordination  — UNCLASSIFIED 


Importance:  High 


SentinelCaseld:  TRANSITORY  RECORD 


b6 

b7C 


Classification:  UNCLASSIFIED 


TRANSITORY  RECORD 

I 1 ' 

hlC 


Any  prognosis  on  document  H-3? 

Sorry  I missed  your  earlier  email.  They  have  55,000  emails— how  many  we  will  see  is  uncertain. 

IZZI 


Classification:  UNCLASSIFIED 


1 


ALL  Il'IFORliATIQH  C™TAIWEB 


l(RMD)  (FBI) 


HEREIH  IS  UNCLASSiriSC 

DATE  11-07-;01«  BY  J37JS5T-34  IJSICC 


From: 

Sent: 

To; 

Subject; 


I 1(RMD)  (FBI) 

iiniOf-saaff^«DolI091KQ.1i5l8  ' 


t 


RE;  State  Department  Emails  -FOIA  Coordination  ---  UNCLASSIFIED 


SentinelCaseld:  TRANSITORY  RECORD 


Classification:  UNCLASSIFIED 

TRANSITORY.  RECORD 

Thankd  I certainly  understand  CTD's  focus 


From:!” 


](CTD)(FBI) 


Sent!ilih>!ir;jd^'^l>A^iirQ91>i~CliM&:-S4>Alviai 


To; 
Subject: 


W 


pMD)  (FBI)' 

State  Department  Emails  --FOIA  Coordination  — UNCLASSIFIED 


Classification:  UNCLASSIFIED 
TRANSITORY  RECORD 


Front  office  made  unexpected  edits  late  yesterday  which  caused  us  a delay.l  I who  did  the  original  work  was  out 
sick  yesterday  so  we  were  unable  to  finish  the  product  by  COB.  Once  he  is  in  this  morning  this  will  be  his  first  priority 
and  we  will  hand  carry  it  back  to  the  front  office. 

Respectfully, 


From: 

RMD)  (FBI) 

Sent;  Wednesday.  ApTi 

08,  2015  10:59  AM 

To; 

I 

■CrD)(FBI) 

(RMD)  (FBI) 

CC! 

Subject:  State  Department  Emails  --FOIA  Coordination  — UNCLASSIFIED 

Importance;  High 


Classification:  UNCLASSIFIED 
TRANSITORY  RECORD 


[ 


Any  prognosis  on  document  H-3? 


CECLAS3IFIEC  BY:  HSICG  J37JS5T34 
OH  11“07~201'S 


From; 

Sent; 

To: 

Cc: 

Subject: 


jiDiatsi 


IfCTDl  fFBIl 


HEIpnFBI)  , 
IfRMnWFRIvI 


(CTD)(FBI)| 

RE:  State  Department  Emails  --FOIA  Coordination  — SECRET 


](CTD)(FBi) 


SentinelCaseld:  TRANSITORY  RECORD 


be 

b7C 

b7E 


Classification:  SfcRET/ 

Classified  By:  F48M55^72 

Derived  From:  FBI  l^lV  dated  20120629 

Declassify  On:  20M123\ 


TRANSITORY  RECORD 

(U)|  I 

bVC 

(U)  Attached  is  the  e-mail  in  question  with  the  text  CTO  thinks  should  be  redacted  highlighted  in  yellow*  In  the  margins 
weVe  indicated  the  pertinent  FOIA  exemptions.  If  you  have  any  questions,  please  let  us  know.  Thanks. 

■ffi 

;05739808  - Work 
- CTD  ftedactl... 

iU) 


(U)  Biessed  ore  they  who  mointoin  justice, 
who  constonffy  do  what  is  right^ 

- Psalm  106:3 


Fromj  |fRMD>fFB»  b6 

Serit!  Monday.  April  Q6.  2015  2:37  PM  b7C 

To:|  \_JCTD)(FBI) 

Cc:| li^D)  (FBI);  JUPINA,  MICHELLE  A (RMOXFBI);  NEAGLE,  LOUISE  M (RMD)CFBI) 

Subject;  State  Department  Emaiis  -FOIA  Coordination  — SECRCF- 
Importanoe:  High 


Classification:  SES^T 
Classified  By:  J2^9^32 


1 


From: 

Sent: 

To: 

Cc: 

Subject: 

SentinelCaseld: 


TRANSITORY  RECORD 


Forwarded  to  State.  Thanks! ! ! 


TRANSITORY  RECORD 


Subject:  RE;  State  Department  Emails  --FOIA  Coordination  —SECRET 


Classification  :\^CRET 
Classified  By: 

Derived  From:  FBI  NSK^TN^ted  20120629 
Declassify  On:  20^/01231 

TRANSITORY  RECORD 

(U| 

(U)  Attached  is  the  e-mail  in  question  with  the  text  CTD  thinks  should  be  redacted  highlighted  in  yellow.  In  the  margins 
we've  indicated  the  pertinent  FOIA  exemptions.  If  you  have  any  questions,  please  let  us  know.  Thanks. 

« File:  C0S739808- Work -CTD  Redactions.pdf  » 


(U)  Blessed  ore  they  who  mointoin  justice, 


hS 

hlC 


hS 

hlC 


1 


DECLASSIFIED  BY:  HSICG  JS7_1S5TS4 
Oil  11““D7“201‘£ 

■ ■ hlC 


From: 

Sent: 

To: 

Cc: 


Subject: 


ndav 


(CTD)(FBI)1. 


1rMD}(FBI} 
BsteaaaiaeTgiaw 
__l(CTDf{FBI) 
[miuim  VFFtivf 


b7E 


I 


MICHELLE  A (RMD)(FBI):  NEAGLE,  LOUISE  M (RMD)(FBI) 

RE;  State  Department  Emails  --FOIA  Coordination  — SECRE'F- 


JUPINA, 


Importance:  High 

SentinelCaseld:  TRANSITORY  RECORD 


Classification:  ^ECRET  / 

Classified  By:  J23J^lpT32 

Derived  From:  FBI  t^S^,  dated  20120629 

Declassify  On:  20^012^ 


TRANSITORY  RECORD 

b7C 

Just  received  a call  from  State,  They  want  to  argue  about  the  bl  portion.  We'll  need  to  discuss,  are  you  free  at  2:00?  I 
suspect  they  may  call  AD  Steinbach, 

Thanks, 

IZZI 


Fromj  tRMDXFB^ 

Sent:  Thursday.  AprTfe,  2015  11:22  AM 


To: 

J{r-mUFBn 

r 

Cc: 

[(RMD)  (FBI): 

(CTD)tFBI)J 

|[CTD)(FBI);[ 

Subject:  RE;  State  Department  Emails  -FOIA  Coordination  — SECRET 


be 

b7C 

b7E 


Classification : ^SECRET  / 

Classified  By:  J23J^^32 

Derived  From:  FBI^NsiC^  dated  20120629 

Declassify  On:  ^^01233^ 

TRANSITORY  RECORD 

Forwarded  to  State.  Thanks!!! 


Fromi  KCrDHFBi) 


Sent:  Thursday,  April  09,  2015  10:35  AM 


To: 

fRMDl  fFBI) 

Cc: 

, (RMD)  (FBI)J 

KCrD)(FBI); 

CTD)(FBI); 

b6 

b7C 

b7E 


1 


DZCL?J3SIFIED  BY:  NSICG 
OM  11-07-201S 


From: 

Sent: 

To: 

Subject: 


I IfRMD)  (FBt) 

Friday.  May  22.  2015  11:39  AM 
I kOGC)  (FBI) 

FW:  Coordination  Review  - Segment  H*3  — GCCnCT/ZNOFOnN 


Importance:  High 


SentinelCaseld:  TRANSITORY  RECORD 


Classification:  ^CRET//NOFORN 


Classified  By:  J23J98T^ 

Derived  From:  FBI  NSIO^^ted  20130301 
Declassify  On;  204(^:231 

TRANSITORY  RECOrS^ 


From 

sent: 

To:Q 

ce:  BONDY,  THOMAS  M (OGC)(F8I) 

Subject:  FW:  Coordination  Review  - Segment  H-3  — GCCRCT//NOrORN 
Importance;  High 


(RMD)  (FBI) 


Classification:  sXcRET//NaFORN 


Classified  By;  J23J9f 

Derived  From:  FBI  NSIX^X dated  20120629 
Declassify  On:  204^^31 

TRANSITORY  RECORf 

IZZI 


You're  about  to  get  drug  into  an  issue  on  classification  of  the  Clinton  emails.  They  are  contesting  CTD's  classification 
decision  and  would  like  to  discuss  it  with  you.  (Forum  shopping  I believe.)  I'll  call  you  and  give  you  some  info,  then 
they've  asked  if  you  could  call]  ](last  name  I think)  | | 

1=^ 


Fromj  |(RMD)  (FBI) 

Sent:  Thursday,  April  09,  2015  11:19  AM 
To;  JUPINA.  MIOiELLE  A fRMDV FBI) 

Cc:|  IfRMPjfFBI):  NEAGtE,  LOUISE  M {RMD)(FBI) 

Subject:  FW:  Coordination  Review  - Segment  H-3  — SECRET/ZNOFORN 
Importance:  High 


RMD)  (FBI) 


DECLASSIFIED  BV;  HSICG  J37JSST34 
□H  1 1-0 7 -201 « 


From: 

Sent; 

To: 

Subject: 

Importance: 

SentinelCaseld: 


l(CTD)  (FBI) 

FW:  State  Department  Emails  --FOIA  Coordination  • 


TRANSITORY  RECORD 


Classification  :\SECRET 

Classified  By:  J23J^S^2 

Derived  From:  FBI^^IC^Xdated  20120629 

Declassify  Oni:  ^2^401231 

TRANSITORY  RECORD 


I've  called  the  State's  Legal  Advisor's  Office  a number  of  times  and  haven't  connected.  As  they  seemed  to  be  wanting  to 
resolve  this  quickly.  I'm  surprised.  I wonder  if  they  gave  up  on  me  and  went  higher.  Have  you  heard  anything  about 
approaches  to  your  AD?  I'm  also  checking  with  OGC  to  see  if  they  went  directly  to  them. 


From:| |(RMD)  (FBI) 

Sent;  Monday.  April  27,  2015  1:16  PM 

To:|  1 (CTD)  (FBI)  ^ ^ ^ ^ 

Cc:l  KRMPXFBDl  l(CTD)(FBI)|  tCTD)(FBI):l 

I KOGC)  (FBI);  JUPINA,  MICHELLE  A (RMD){FBI);  NEAGLE,  LOUISE  M {RMD)(FBI) 

Subject:  RE:  State  Department  Emails  -FOIA  Coordination  — -SCCRCT 
Importance:  High 


Class!  ficat  ion  KSECRET 


Classified  By:  J23J^T32 

Derived  From:  FBI/NS^C,  dated  20120629 

Declassify  On:  2'D40123V. 

TRANSITORY  RECORD 


Just  received  a call  from  State.  They  want  to  argue  about  the  bl  portion.  We'll  need  to  discuss,  are  you  free  at  2:00?  I 
suspect  they  may  call  AD  Steinbach. 


Thanks, 


1 


CECLASSIFIEC  BY:  NSICG  J37J85T54 
W 11““07“2016 


|(RMD)  (FBI) 

From:  I ItCTDWFBh 

Sent:  sssa  ne's'oa';WAT>niKaf2~OjlSte5i:9!gi^ 

To:  I l(RMD)  (FBI) 

Subject:  KE;  State  Department  Emails  -FOIA  Coordination  — OCCRCT' 

SentinelCaseld:  TRANSITORY  RECORD 


Classification:  SECRET 

Classified  By;  F48M57)!|<^ 

Derived  From:  FBI  HSiC,  idated  20120629 
Declassify  On:  20401231 


TRANSITORY  RECORD 

(U)  I've  not  heard  anything  about  approaches  to  my  AD,  but  I'll  have  my  UC  double-check  at  the  4pm  close-out  meeting 
with  exec  management. 

(U)  Just  as  an  FYI,  I've  also  not  heard  anything  back  yet  from  the  LE6AT. 


b6 

b7C 


b6 

b7C 


From:|_ 


(RMD)  (FBI) 


Sent;  Wednesday.  April  29.  2015  1:36  PM 
To;l  IfCTD)  (FBI) 

Subject:  FW:  State  Department  Emails  --FOIA  Coordination  — SECRET 
Importance:  High 


b6 

b7C 


Classification : \SECRET  / 

Classified  By;  J23J^(^32 

Derived  From:  FBIyl^SlC^  dated  20120629 

Declassify  On:  ^CM0123r\ 

TRANSITORY  RECORD 


I've  catted  the  State's  Legal  Advisor's  Office  a number  of  times  and  haven't  connected.  As  they  seemed  to  be  wanting  to 
resolve  this  quickly.  I'm  surprised.  I wonder  if  they  gave  up  on  me  and  went  higher.  Have  you  heard  anything  about 
approaches  to  your  AD?  I'm  also  checking  with  OGC  to  see  if  they  went  directly  to  them. 


b6 

b7C 


1 


CECLASSIFIEC  BY:  HSICC  J37J35T54 
□II  11-07-2016 


From: 

Sent: 

To: 

Subject: 


MiliOiliSiEKxasral 


L 


IrMD)  (FBh  _ 
!nlg§y2Q/i;5?2?5^9IRMI 
^{CTD)  (FBI) 


RE:  State  Department  Emails  --FOIA  Coordination  — SECRET 


SentinelCaseld:  TRANSITORY  RECORD 


Classification:  S^RET  / 

Classified  By:  J23J^&!t32 

Derived  From:  FBI  dated  20120629 

Declassify  On:  2Q401231\ 


TRANSITORY  RECORD 


b6 

b7C 


Thanks!  I don't  see  any  urgency  at  this  point. 


From:l  tCTD)  (FBI)  b6 

Sent:  Wednesday,  April  29, 2015  2: 19  PM  b7c 

Toj  ~n(RMD)fFBn 

Subject:  RE:  State  Department  Emails  -FOIA  Coordination  — SECRET 


Classif icatior 

Classified  By: 
Derived  From: 
Declassify  On: 


TRANSITORY  RECORD 


b6 
b7C 

(U)  I've  not  heard  anything  about  approaches  to  my  AD,  but  I'll  have  my  DC  double-check  at  the  4pm  close-out  meeting 
with  exec  management. 

(U)  Just  as  an  FYl,  I've  also  not  heard  anything  back  yet  from  the  LEGAT. 


Fromj  IfRMDVfFBT^  b6 

Sent:  Wednesday,  April  29,  2015  1:36  PM  b7c 

To;l  I (CTD)  (FBI) 

Subject:  FW:  State  Department  Emails  -FOIA  Coordination  — SECRET 

Importance:  High 


Classification:  SECReT 


:^T 


1 


UECLkSSlTJEL  BY;  N5ICG  J37J85T54 
□M  ll-D7"'20i€:  hS 

■ b7C 


From: 

Sent: 

To: 

Subject: 


j^RMD)  (FBI) 


RE:  State  Department  Emails  --FOIA  Coordination  — SECRET 


](RMD)  (FBI) 


SentInelCaseld:  TRANSITORY  RECORD 


Classification:  S^REy 

Classified  By:  J23j\aT32 

Derived  From:  FBI  HEXc,  dated  20120629 

Declassify  On: 


TRANSITORY  RECORD 


I believe  the  first  document  reviewed  was  part  of  this  batch-but  am  not  entirely  sure. 


b6 

b7C 


State  Department  Provides  New  Benghazi  Documents  To  House  Panel.  Chris  Wallace  reported  on  Fox  News’ 
Special  Report  (4/30,  1.53M)  that  the  Stale  Department's  Benghazi  Accountability  Review  Board  “turned  over  more  than  4,000 
pages  of  documents  and  notes  to  the  House  Select  Committee  on  Benghazi,”  Committee  Chairman  Trey  Gowdy  said  the 
documents  “were  recently  subpoenaed  a second  time  after  the  initial  request  two  years  ago,"  adding  that  he  “is  still  waiting  for  the 
Department  to  produce  other  records  that  have  also  been  requested  or  subpoenaed." 

Politico  (4/30,  French,  1.1 1M)  reports  that  the  documents  “were  not  reviewed  by  the  other  half-dozen  committees  that 
■investigated  the  2012  attacks."  Gowdy  said,  “Corrtrary  to  those  who  said  all  had  been  asked  and  answered,  the  Benghazi  Committee 
has  shown  there  is  more  still  for  Congj^ss  to  consider.”  The  Washington  Times  (5/1,  Sherfinski,  641 K)  reports  that  Democrats  “on 
the  committee  have  said  a handftil  of  investigidioris  into  the  attack  have  already  been  done  and  say  Republicans  are  using  the 
committee  as  a way  to  attack"  Hillary  Clinton. 

USA  Today  (5/1,  Page,  5.01  M)  reports  that  Gowdy  also  “says  he  might  be  willing  to  accept  assurances  under  oath  from  Hillary 
Clinton  that  she  has  provided  all  her  relevant  emails  to  the  panel  — dropping  requests  for  an  independent  examination  of  her 
computer  server."  He  told  “Capitol  Download,"  “If  she  were,  under  some  theory,  able  to  say,  'yes,  I can  promise  you  under  penalty  of 
perjury  you  have  every  single  document  you're  entitled  to,'  that  would  probably  shut  off  that  line  of  inquiry.  If  she  can.  then  it  will  be  a 
short  conversation  ” 


I (CTD)  (FBI)  b6 

Sent:  Wednesday.  April  29,  2015  2:19  PM  b7c 

To:  I IfRMD)  (FBI) 

Subject:  RE:  State  Department  Emails  --FOIA  Coordination  — SCCRET 


Classification ; 


:ret 


Classified  By:  F48M57^ 
Derived  From:  FBI  N$TC,  dS^d 


20120629 


1 


ALL  IHFCMa.TIQH  Ca^TAINED 
HEREIH  IS  UWCLA3SIFISC 

DATE  11-07-201'5  BY  J37J85T94  NS  ICG  b6 

-■  b7C 


From: 

Sent: 

To: 

Cc: 

Subject: 

SentinelCaseld: 


I IfRMD^  (FBI) 

I l(CTDWFBnT  l(CTD)fFBn 

JUPINA,  MICHELLE  A {RMD)(FBI);  NEAGLE,  LOUISE  M (RMD)(FBI) 
HRC  Email  — UNCLASSIFIED//P©y© 

TRANSITORY  RECORD 


IfRMD)  (FBI) 


Classification:  UNCLASS  I FIED//-Pm» 
TRANSITORY  RECORD 


I I t>6 

b7C 

Just  a head's  up.  I got  a call  fronri  loD.  concerning  the  classified  HRC  email.  He  received  a call  from 

State  asking  if  we  would  revisit  the  issue.  I directed  him  to  CTD  as  the  ultimate  SME  on  harm  and  the  classification 
decision.  (I  did  tell  him  as  an  OCA  I concurred  in  the  markings.) 


Classification;  UNCLASSIFIED//TT7Dn 


t 


ALL  IMFOESfATIOH  COt-TTAIl-rEE 


HZRZIN  IS  UlKL.AS3IiIEB 

DATE  li~07-'2016  BY  J373S5T34  KSi; 


From; 

Sent: 

To: 

Cc: 

Subject: 


(£51) 


(RMD)(FBI): 


{RMD)  (FBI); 


□{RMD)(FBI) 

NEAGLE.  LOUISE  M (RMD)(FBI) 

RE:  TRIM  Document ; 15/DO/1703  : Letter  from  Patrick  F.  Kennedy,  Department  of  State 
(DOS),  advising  of  the  receipt  of  55.000  pages  of  e-mails  from  former  Secretary  of  State 
Hillary  Clinton  and  requesting  a senior  FBI  official  to  coordinate  the  FBI's  revi 


SentinelCaseld;  NON-RECORD 


b6 

b7C 


Classification:  UNCLASSIFIED 


Boss  just  sent  an  email  to 


saying  I’ll  be  the  official. 


Original  Meggage- 

From:  | ] (RMD)(FBI) 

Sent:  Monday,  Hay  18.  2015  2:27  PM 
To:  I I (RMD)  (FBI)J 

Cc:  NEAGLEj  LOUISE  H (RMD) (FBI) 


(RMD)  (FBI)j 


(RMD) (FBI) 


Subject:  RE:  TRIM  Document  : 15/DO/1703  : Letter  from  Patrick  F.  Kennedy,  Department  of  State 
(DOS),  advising  of  the  receipt  of  55.000  pages  of  e-mails  from  former  Secretary  of  State 
Hillary  Clinton  and  requesting  a senior  FBI  official  to  coordinate  the  FBI's  revi 


Classification:  UNCLASSIFIED 


b6 

bVC 


No 


Original  Message-- — 

From: I 1 (RMD)  (FBI) 

Sent:  Monday.  May  18.  2015  2:26  PM 
To:  I I (RHD)(FBI);| 

Cc:  NEAGLE,  LOUISE  M (RMD) (FBI) 


JrmD)  (FBI); 


(RMD) (FBI) 


Subject;  RE;  TRIM  Document  : 15/DO/1703  : Letter  from  Patrick  F.  Kennedy,  Department  of  State 
(DOS),  advising  of  the  receipt  of  55.000  pages  of  e-mails  from  former  Secretary  of  State 
Hillary  Clinton  and  requesting  a senior  FBI  official  to  coordinate  the  FBI's  revi 


Classification:  UNCLASSIFIED 


b6 

b7C 


has  anyone  suggested  to  you  that  our  POC  will  be  anyone  other  than 

Thanks  _ 


Original  Message 


From: 

Sent:  Monday,  May  18.  2015  2:04  PM 


(RMD) (FBI) 


To:[ 


(RMD)  (FBI);[ 


] (RMD)  (FBI); 


(RMD) (FBI) 

Cc:  WEA6LE,  LOUISE  M CRMD)(FBI) 

Subject:  FW:  TRIM  Document  : 15/DO/1703  : Letter  from  Patrick  F,  Kennedy^  Department  of  State 
(DOS),  advising  of  the  receipt  of  53.000  pages  of  e-mails  from  former  Secretary  of  State 
Hillary  Clinton  and  requesting  a senior  FBI  official  to  coordinate  the  FBI's  revi 


hS 

hlc 


hS 

hlC 


1 


Classification:  UNCLASSIFIED 


Good  afternoorij  please  note  the  short  deadline  (tomorrow! ! ) for  response  to  the  Department  of 
State . 


Original  Message 

From:  ExecSec  (DO) (FBI) 

Sent:  Monday,  May  18,  2015  1:55  PM 

To:|  I(RM0)(FBI);  3UPINA,  MICHELLE  A (RMD)(FBI^ 

WEAGLE,  LOUISE  M (RMD)(FBI):I  I (RMD)  (FBI);f 

I l(BMD)  (FBI) 


T(6gC)  (FBI);  [ 


] (0GC)(FBI);[ 


□(RMD)  (FBI); 
J(^RMD)(FBI); 


1 (OGC) 


(FBI); I ](DO)(OGA);  lOHNSON,  GORDON  B.  (DO)  (FBI);  PERKINS,  KEVIN  L.  (DO) 

(FBI);1  I (DO)  (FBI);|_  J(DO)(FBI);[ 

(DO) (FBI);  GIULIAWO,  MARK  F (DO)  (FBI); 


{FBI);[ 


] (DO)(OGA) 


(CTD)(FBI); 


(DO) 


Subject;  trim  Document  : 15/DO/1703  ; Letter  from  Patrick  F.  Kennedy,  Department  of  State 
(DOS),  advising  of  the  receipt  of  55.000  pages  of  e-mails  from  former  Secretary  of  State 
Hillary  Clinton  and  requesting  a senior  FBI  official  to  coordinate  the  FBI's  revie  -- 


b6 

b7C 


Classification:  UNCLASSIFIED 


NOTE  TO  RMD:  This  TRIM  document  has  a short  deadline  of  5/19/15. 

ACTION  OFFICE:  RMD 

The  above  division,  designated  as  the  action  office,  is  assigned  the  attached  Director's 
Office  correspondence  for  preparation  of  a response  over  the  signature  of  YOUR  APPROPRIATE 
DIVISION  OFFICIAL  by  the  DUE  DATE  indicated  below.  The  original  will  be  forwarded  to  the 
action  office's  point  of  contact.  INFORMATION  ONLY  electronic  copies  are  being  sent  to  OGC, 
Chief  of  Staff,  Associate  Deputy  Director,  Deputy  Director  and  Special  Counsel  to  the 
Director. 


IMPORTANT  NOTE:  you  represent  an  FBI  Field  Division  and  are  receiving  this  e-mail,  you 

are  being  provided  a copy  of  correspondence  which  has  come  to  the  attention  of  the  Director, 
or  other  FBI  exeartavs.  Ypu  are  not  being  tasked  with  any  action  in  this  regard  by  the  FBI’s 
Office  of  the  ExectitiVe  Secretariat.  You  are  being  provided  a courtesy  copy  only. 

I 

Responses  handled  through'  other  means^  such  as  via  telephone  contact,  e-mails,  etc,,  should 
be  forwarded  to  the  ExecSec  via  e-mail,  and  must  include  the  Trim  DO#  and  sufficient  relevant 
data,  such  as  date,  contact,  and  disposition,  to  allow  ExecSec  to  close  the  pending  action. 

If  this  matter  needs  to  be  reassigned  to  another  entity,  the  FBI  ExecSec  should  be  advised 
immediately  (within  2 days  of  e-mail  receipt).  The  ExecSec  will  need  to  know  to  whom  the 
request  should  be  reassigned,  together  with  a point  of  contact  (if  known),  and  the  original 
correspondence  will  need  to  be  returned  to  ExecSec,  Room  6147, 

ACTION  OFFICE  INSTRUCTIONS:  (Failure  to  comply  with  the  following  instructions  will  delay 
the  closing  of  pending  action  and  will  result  in  the  correspondence  appearing  on  the  overdue 
report) 

A,  Response  Preparation : 


2 


1.  Prepare  the  following; 

-One  UNDATED  letterhead  copy, 

-An  envelope  or  mailing  label, 

-A  blocked  yellow  UNDATED  file  copy,  attaching  the  original  incoming  correspondence  to  the 
yellow  file  copy,  and  a copy  of  the  incoming  to  each  designated  ''courtesy  copy"  (cc),  as 
appropriate.  The  yellow  copy  mail  room  block  must  be  checked  and  initialed,  and  the  TRIM 
number  noted  on  the  yellow  (can  be  handwritten). 

2.  At  a minimum,  the  copy  count  must  include  the  following  copy  designation : 

Trim  XX/DO/XXXX 

1 - (Your  confirmation  white  copy,  if  desired) 

B.  Routing  of  the  Final  Response  Package: 


1.  Route  your  final  response  package  to  the  FBI  ExecSec,  Room  6147.  The  FBI  ExecSec  will 
forward  the  completed  package  to  the  mailroom  for  delivery. 

< TRIM  Record  Information  > 


Record  Number  : 15/DO/1703 

Date  Due  ; Tuesday,  May  19,  2015 

Addressee  : AD-Records  Management  (Addressee) 

Current  Action  PREPARE  RESPONSE  PER  INSTRUCTIONS  (Responsibility  of:  Executive 

Secretariat,  Due  5/19/2015  at  1:43  PM  (14  hours,  55  minutes)) 

All  Contacts  : AD-Records  Management  (Addressee) 

Office  of  General  Counsel  (Other) 

Chief  of  Staff  (Other) 

Associate  Deputy  Director  (Other) 

Deputy  Director  (Other) 

Special  Counsel  to  the  Director  (Other) 

Access  DB  or  Workflow 

From  KENNEDY,  PATRICK  F. 

Constituent  : 

Title  (Free  Text  Part)  : Letter  from  Patrick  F.  Kennedy,  Department  of  State  (DOS), 

advising  of  the  receipt  of  55.000  pages  of  e-mails  from  former  Secretary  of  State  Hillary 
Clinton  and  requesting  a senior  FBI  official  to  coordinate  the  FBI's  review  with  their  FOIA 
team. 

Notes  : RMD  advised  during  electronic  routing  that  there  is  a short  deadline  for  this 

TRIB  record. 


'Monday,  May  18,  2015  at  1:44:50  PM  (GMT-04:00) 


la'  e Communication  ; Thursday,  May  14,  2015 
lelateo  Records  : 


b6 

b7C 


Classification:  UNCLASSIFIED 

Classification;  UNCLASSIFIED 

Classification:  UNCLASSIFIED 


3 


Classification: 


Classification: 


UNCLASSIFIED 


UNCLASSIFIED 


-i 


From: 

Sent; 

To: 

Subject; 


ItOe's'dajrjllOlipTgl  _ 

JUPINA.  MICHELLE  A (RMD)(FBI) 

HRC  Emails  — UNCIASSIFIED//FOUO 


Importance;  High 

SentinelCaseld;  TRANSITORY  RECORD 


FBI  IHFO 

CLASSIFIED  BY;  H3ICG  J37JS5T54 
REASCl'J:  1.4  <C) 

DECLASSIFY  Ot-f:  12-31-2C4C 
DATE:  11-07-2016 


Classification:  UNCLASS I FIED//F0U0 
TRANSITORY  RECORD 


Michelle, 


Just  returned  from  the  meeting  at  State  hosted  by  USS  Kennedy  concerning  HRC  emails.  After  discussing  the  logistics  of 
any  consultations  regarding  the  SS,000  pages  in  order  to  meet  a court-ordered  Jan  2016  deadline.  Secretary  Kennedy 


requester^ 


DoJ/OIP,  and  me  to  stay  behind  to  discuss  the  FBI  determination  of  classified  material  in  an 
initial  batch  of  296  emails  dealing  with  Benghazi.  These  emails  were  processed  in  response  to  a request  by  the  House 
Select  Committee  on  Benghazi,  they  were  processed  using  FOIA  guidelines. 


State  Department  referred  the  document  to  us  for  our  review.  I passed  the  email  to  CTD  who  reviewed  and  marked  the 
document  with  FBI  equities.  Included  was  one  line  marked  with  the  with  classification  "SECRET."  Attached  is  the  email 
In  question  with  markings.  As  an  OCA,  this  marking  was  entirely  consistent  with  the  thousands  of  FBI  documents  I've 
reviewed  over  the  years.  State  OLC  contacted  me  initially  objecting  to  the  classification.  Later  Secretary  Kennedy 
contact  ed| 


in  lOD,  who  then  contacted  me.  I've  notified  CTO  Exec  Sec  in  each  instance  of  the  contact. 


The  redaction  lists  "interference  with  foreign  relations"  as  the  rationale.  The  crux  of  States  argument  is  they  know 
better  what  will  impact  foreign  relations  and  there  is  no  longer  a government  in  place.  The  more  appropriate  rationale 
is  sources  and  methods.  While  the  email  does  not  name  the  particular  official,  this  might  be  deduced  and,  given  the 
threat  of  violence  in  this  region,  any  surmise  could  be  fatal  for  whoever  cooperated  with  us.  State  will  say  no  one  will 
know  if  it  is  redacted,  but  that  is  not  how  classification  works. 


This  all  said,  CTD  is  ultimate  decider  as  to  the  level  of  harm  contained  in  the  information.  I told  Secretary  Kennedy  this 
and  he  said  he  would  be  calling  AD  Steinbach. 


□ 


"Here  is  our  response.  I recommend  you  go  ahead  and  classify  the  forwarding  email  to  us  in  the  future  in  case  we 
determine  there  is  classified  information.  This  marking  was  approved  by  the  CTD  front  office.  The  first  bracket  starts 

The  bl  marking 


with,  "Apparently...",  the  second  bracket  starts  with,  "The  A/RSO...",  the  third  bracketr 
isSECRET/ZNOFORN,"  *- 


■ffi 

:05739808  - Work 
' CTD  RedactL. 


I 


ALL  ii-troa^jATioi-r  doht aimed 

HEREIN  IS  UWCLASSiriED 

CATE  ll-'07~20ifi  BY  J37JS5T34  NSICC  jjg 

■INI  bVC 


From; 

Sent: 

To: 


Cc: 


Subject: 


ST^BACH.  MICHAEL  B.  rCTD)  (FBI) 

GIACALONE.  JOHN  (pO)fFBn:  JUPINA.  MICHELLE  A (RMD)(FBlf 
fFBlH  ^OTD)  fFBH  ^ 

IfnVnwFRnj  — . ](CtD)  (fbi)[_ 


]RMD) 


(CIO)  {Fb));| 

State  email  FOIA  — UNCLASSIFIED 


|CTD)CFBI} 


SentinelCaseld:  TRANSITORY  RECORD 


Classification:  UNCLASSIFIED 


TRANSITORY  RECORD 

All 

I just  spoke  to  Pat  Kennedy  at  DoS  reference  a State.gov  email  dated  November  18, 2014  07:01PM  from|  | b6 

I land  in  which  the  FBI  was  requested  to  review  a pending  FOIA  request.  b7c 

I advised  him  independent  and  objective  reviews  by  both  RMD  and  CTD  previously  determined  two  portions  needed  to 
be  redacted  based  on  exemption  {b)(l)  - "specifically  authorized  under  criteria  established  by  an  Executive  order  to  be 
kept  secret  in  the  interest  of  national  defense  or  foreign  policy."  We  spoke  earlier  today  and  in  the  conversation 
requested  that,  as  the  Assistant  Director  CTD,  I review  the  content  and  revise  the  determination  and  redact  based  on 
exemption  (b)(7)(D)  only-  "could  reasonably  be  expected  to  disclose  the  identity  of  confidential  source,  including  a 
State,  local,  or  foreign  agency  or  authority..." 

After  discussions  with  RMD  and  CTD  today,  I explained  to  Mr  Kennedy  to  only  exempt  for  (b}(7)(0]  was  not  appropriate 
as  the  information  in  the  two  portions  in  question  was  classified  at  the  Secret/NOFORN  level  and  exemption  {b)(l)  was 
needed  in  addition  to  exemption  {b){7}(D).  Therefore,  I would  not  change  the  original  determination  made  by  the  FBI. 

Michael  B.  Steinbach 
Assistant  Director 
Counterterrorism  Division 

b6 

hlC 


Classification:  UNCLASSIFIED 


1 


ALL  IHFaRl.aTiaLI  Ca^TAIIOED 

HEREm  IS  UiaCLASSIFIEC 

DATE  11-07““201<5  3Y  J37J85T94  NSICG 


][RMD)  (FBI) 

JUPINA,  MICHELLE  A (RMD)(FBI) 
Thursday,  May  21 . 2015  4:16  PM 
I |[RMD)  (FBI) 

FW:  State  email  FOlA—  UNCLASSIFIED 

TRANSITORY  RECORD 


Classification:  UNCLASSIFIED 


TRANSITORY  RECORD 


From: 

Sent: 

To: 

Subject: 

SentinelCaseld: 


From:  3UPINA,  MICHELLE  A (RMD)(FBI) 

Sent: 

To:  RYBICKl,  JAMES  E (DO')(OGA);  GIULIANO,  MARK  F {DO)  (FBI);  GIACALONE,  JOHN  (DO)(FBI);  STtINBACH,  MICHAEL 
B.  (CTD)  (FBI);  BAKER,  JAMES  A (OGC)(FBI) 

Subject:  RE;  State  email  FOIA  — UNCLASSIFIED 


Classification:  UNCLASSIFIED 


TRANSITORY  RECORD 

lis  an  OCA  and  he  can  classify  the  infornnation,  unless  CTD  would  prefer  to  classify  it. 


From:  RYBICKl.  JAMES  E (DO)(OGA) 

Sent;  ilifeMa'^MaiteaiKOyl'ScI  :Q9iRMay 

To:  GIULIANO,  MARK  F (DO)  (FBI);  GIACALONE,  JOHN  (DO)(FBI);  STEINBACH,  MICHAEL  B.  (CTD)  (FBI);  JUPINA, 
MICHELLE  A (RMD)(FBI);  BAKER,  JAMES  A (OGC)(FBI) 

Subject:  FW;  State  email  FOIA  — UNCLASSIFIED 


Classification:  UNCLASSIFIED 


TRANSITORY  RECORD 

State  Department  COS  Jonathan  Finer  called  this  afternoon  reference  this  matter.  He  provided  the  background  on  the 
review  process,  stated  that  he  was  not  attempting  change  the  AD's  classification  decision,  and  said  that  he  just  wanted 
to  make  sure  that  FBI  leadership  was  aware  of  the  decision  and  the  procedural  process  and  media  attention  it  would 
likely  trigger. 

I spoke  to  AD  Steinbach  who  provided  the  background  on  the  decision  and  i relayed  back  to  the  State  Department  that 
leadership  is  aware  of  the  review  process  and  decision.  Mr.  Finer  asked  whether  it  would  be  possible  for  the  FBI  to 
classify  the  information  (as  opposed  to  the  State  Department  classifying  on  behalf  of  the  FBI),  i told  him  that  I would 
Inquire  but  would  defer  to  the  classification  and  FOIA  experts. 


ALL  COJTAir-JED 

BEREm  IS  LTl-JCLASSIFIEC 

D^TE  11“D7-“201‘5  3Y  J31JSbT3^  NSICG 


he 

bVC 


ft 

1(RMD)  (FBI) 


From: 

Sent: 

To: 

Cc: 

Subject: 

SentinelCaseld: 


Rfiaggill!itgag2»2Q'Sp^^ii§lElM^ 
GIACALONE,  JOHN  (DO)(FBI) 

JUPINA,  MICHELLE  A (RMD}(FBI) 

RE:  State  email  FOIA  — UNCLASSIFIED 

TRANSITORY  RECORD 


Classification;  UNCLASSIFIED 


TRANSITORY  RECORD 

Thank  you  sirj  | ^ b6 

b7C 


From:_gACALQNE,  ^ 

To:  lUPIN?MfHSSMRMD)(FBI); 

Cc:  GIUUANO,  MARK  F (DO)  (FBI)  

Subject:  RE:  State  email  FOIA  — UNCLASSIFIED 


RMD)  (FBI) 


b6 

bVC 


Classification:  UNCLASSIFIED 
TRANSITORY  RECORD 

Michelle]  I- Great  job  by  you  and  your  team  on  addressing  the  review  of  the  DoS  emails.  Your  thorough  analysis  b6 

and  recommendation  were  spot  on.  Well  done  - thanks  - John  L7i 


From:  JUPINA,  MICHELLE  A (RMD)(FBI) 

Sent:  Thursday,  May  21,  2015  4:16  PM 

To:  RYBICKI,  JAMES  E (DO){OGA);  GIULIANO,  MARK  F (DO)  (FBI);  GIACALONE,  JOHN  (DO)(FBI);  STEINBACH,  MICHAEL 
B.  (CTD)  (FBI);  BAKER,  JAMES  A (OGC){FBI) 

Subject:  RE;  State  email  FOIA  — UNCLASSIFIED 


Classification:  UNCLASSIFIED 


transitory'  RECORD 

|is  an  OCA  and  he  can  classify  the  information,  unless  CTD  would  prefer  to  classify  it  b6 

b7C 


From:  RYBICKI,  JAMES  E (DO)(OGA) 

Sent:  Thursday,  May  21,  2015  4:09  PM 

To:  GIUUANO,  MARK  F (DO)  (FBI);  GIACALONE,  JOHN  (DO)(FBI);  STEINBACH,  MICHAEL  B.  (CTD)  (FBI);  JUPINA, 
MICHELLE  A ( RMD)(FBI);  BAKER,  JAMES  A (OGC)(FBI) 

Subject:  FW:  State  email  FOIA  — UNCLASSIFIED 


1 


b6 

b7C 


I am  writing  following  our  telephone  conversation  of  earlier  today  regarding  our  client,  Bryan 
Pagliano.  In  response  to  your  inquiry,  we  are  not  prepared  to  have  Mr.  Pagliano  participate  in  an 
interview  with  the  FBI  - particularly  in  the  absence  of  any  explanation  as  to  the  focus  or  scope  of  your 
prospective  questions.  Please  ask  the  Department  of  Justice  lawyer  responsible  for  this  investigation 
to  contact  me  if  further  discussions  are  needed.  Also,  please  convey  to  any  other  DOJ  or  FBI 
personnel  involved  in  your  investigation  that  Mr.  Pagilano  is  represented  by  counsel  and  that  all 
further  inquiries  should  be  directed  to  our  law  firm.  My  full  contact  information  is  provided  below. 


Thanks. 


Mark  MacDougall 


Mark  J.  MacDougall 

AKIN  GUMP  STRAUSS  HAUER  & FELD  llp 


1333  New  Hampshire  Avenue,  N.W.  | Washington,  DC  20036-1564  | USA  | Direct:  | 
Fax:  +1  202.887.4288  ||  I akinQump.com  | ^ 


I Intemail  | 


b6 

b7C 


The  information  contained  in  this  e-mail  message  is  intended  only  for  the  personal  and  confidential  use  of  the 
recipient(s)  named  above.  If  you  have  received  this  communication  in  error,  please  notify  us  immediately  by  e- 
mail,  and  delete  the  original  message. 
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Event  Title: 
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Date:  08/12/2015 
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Drafted 

Case  ID 


By: 

# 


.9!f 


(S//Wt)\ I 

MISHANDLING  OF  CLASSIFIED; 
UNKNOWN  SUBJECT  OR  COUNTRY; 
SENSITIVE  INVESTIGATIVE  MATTER 


[SIM) 


bl 
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^classify 


Full  Investigation  Initiated:  07/10/2015 

Collected  From:  (U)  Platte  River  Networ ks/Equinex 
800  Secaucus  Rd 
SecaucuSf  New  Jersey  07094 


Receipt  Given?:  No 

Holding  Office;  WASHINGTON  FIELD 


Details:  No  Details  Provided 


Item  Type  Description 

IB  Digital  ■ [U)  Dell  Poweredge  2900,  Gray  Color,  S/N  G842PC1 

Collected  On:  08/12/2015 

Seizing  Individual:  | | 

Collected  By:  | | 

Location  Area:  NA 

Specific  Location:  NA 

Device  Type : Computer 

Serial  Number : G842PC1 

Number  of  Devices  Collected : 1 
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This  document  contains  neither  recommendations  nor  conclusions  of  the  FBJ  It  is  the  property  oi  the  FBI  and  is  loaned  to  your  agency;  it  and  its 
contents  are  not  to  be  distributed  outside  your  agency. 
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Title : 
Re: 
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FD-302a(Rev.  10^6-95) 


ALL  lUFOm-iA^lDlJ  C01']'TAIMED 
_J_  HEBZIN  IS  UIICLASSiriED 

CATE  10-31-201^  BY  J27JS5T34  MfSICC 


FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  07/3 1/2015 


On  the  morning  of  July  31,  2015,  Federal  Bureau  of  Investigation  (FBI)  Special  Agent  (SA)E 
Received  a voicemail  on  her  desk  telephone  from  a woman  identifying  herself  as 


from[ II |advised  she  represented  the  clients  at  Platte  River  Networks  who  were 

recently  provided  a copy  of  a preservation  letter  from  the  FBI.  I Istated  on  the  voicemail  that  she 

advised  her  clients  to  ''follow  the  instructions  on  the  letter  to  thef\l  then  stated  that  if  the  FBI  had 
any  further  questions  regarding  the  letter  to  contact  her  at  telephon 


S A telephoned later  the  same  morning  at 


her  voicemail  and  appreciated  the  contact. 


to  advise  she  received 


b6 

b7C 


hS 

bVC 


investigation  on  07/31/2015 at Denver.  Colorado 

File#  I Date  dictated  N/A 


Bysd  I 

This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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U.S.  Department  of  Justice 


Federal  Bureau  of  Investigation 

Washington,  D.C.  20535-0001 


Date:  August  11,  2015 

To:  John  Kerry 

Secretary  of  State 
U.S.  Department  of  State 

From:  Charles  H.  Kable 

Section  Chief 
Counterespionage  Section 
Counterintelligence  Division 


ALL  IHrOFaiATIOW  COKTAINSE 

HSRZIN  IS  UIJCLASSiriEB 

DATE  10-31-20ie  BY  J37J85T-34  KSICGi 


Subject:  Request  for 


On  July  6,  2015,  the  FBI  received  a Section  811(c)  Referral  from  the 
Inspector  General  of  the  Intelligence  Community  regarding  the  potential 
compromise  of  classified  information.  Pursuant  to  this  referral,  FBI 
respectfully  reonostsl  I 


1. 

2. 

3. 

4. 

5. 

6. 

7. 

8. 
9. 
10 
11 
12, 
13, 

14 

15 


b7E 


b6 

b7C 

b7E 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your 
agency;  it  and  its  contents  are  not  to  be  distributed  outside  your  agency. 


You  are  also  requested  not  to  disclose  the  existence  of  this  request , other  than  as  necessary  to  comply 
with  this  request,  as  the  FBI's  investigation  may  be  jeopardized  by  this  type  of  disclosure, 

If  you  have  any  questions  regarding  this  request^  please  direct  all  inquiries  to  Special  Agent 

kvho  can  be  reached  all  I 


Sincerely, 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your 
agency;  it  and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C.  20535-0001 


ALL  IHFOFiaTIOW  COHTAIl'lSE 
3E3iIH  IS  Ul-ICLASSIFIED 
DATE  11~07~201£  BY  J37J85T54 


HSIC 


August  12,  2015 


Re:  Request  for  Preservation  of  Records 

Pursuant  to  Title  18,  United  States  Code  Section  2703(f),  this  letter  is  a formal  request  for 
the  preservation  of  all  records  and  other  evidence  in  your  possession  regarding  the  domain 
account  @cIintoneinail.coin,  pending  further  legal  process. 

You  are  hereby  requested  to  preserve  the  records  described  below  currently  in  your 
possession,  including  records  stored  on  backup  media,  in  a form  that  includes  the  complete 
record,  and  records  that  may  come  into  your  possession  from  the  date  of  acknowledgment  of  this 
request  until  receipt  of  a legal  court  order.  You  are  also  requested  not  to  disclose  the  existence 
of  this  request  to  the  subscriber  or  any  other  person,  other  than. as  necessary  to  comply  with  this 
request,  as  the  FBI's  investigation  may  be  jeopardized  by  this  type  of  disclosure.  You  are  also 
requested  not  to  close  the  account  of  the  subscriber,  unless  requested  to  do  so  by  the  subscriber. 
If  compliance  with  this  request  may  result  in  a permanent  or  temporary  termination  of  service 
to  the  accounts  described  below,  or  otherwise  alert  the  subscriber  or  user  of  these  accounts  as 
to  your  actions  to  preserve  the  referenced  files  and  records,  please  contact  Special  Agent 

as  soon  as  possible  and  before  taking  any  such  actions. 


This  preservation  request  applies  to  the  following  records  and  evidence: 

A.  All  stored  electronic  communications  and  other  files  reflecting  communications  to 
or  from  the  requested  account. 

B.  The  contents  of  any  communication  or  file  stored  by  or  for  the  account  and  any 
associated  accounts,  and  any  information  associated  with  those  communications 
or  files,  such  as  the  source  and  destination  email  addresses  or  IP  addresses. 

C.  All  records  and  other  evidence  relating  to  the  subscriber(s),  customer(s),  account 
holder(s),  or  other  entity(ies)  associated  with  the  requested  account  including, 
without  limitation,  subscriber  names,  user  names,  screen  names  or  other  identities, 
mailing  addresses,  residential  addresses,  business  addresses,  e-mail  addresses  and 
other  contact  information,  telephone  numbers  or  other  subscriber  number  or 


identity,  billing  records,  information  about  the  length  of  service  and  the  types  of 
services  the  subscriber  or  customer  utilized,  and  any  other  identifying 
information,  whether  such  records  or  other  evidence  are  in  electronic  or  other 
form;  and 

D.  All  connection  logs  and  records  of  user  activity  for  the  requested  account, 
including: 

1.  Connection  date  and  time; 

. 2.  Disconnect  date  and  time; 

3.  Method  of  connection  (e.g.,  telnet,  ftp,  http); 

4.  Data  transfer  volume; 

5.  User  name  associated  with  the  connection  and  other  connection 
information,  including  the  Internet  Protocol  address  of  the  source  of  the 
connection; 

6.  Telephone  caller  identification  records;  and 

7.  Connection  information  for  other  computers  to  which  the  user  of  the 
above-referenced  accounts  connected,  by  any  means,  during  the 
connection  period,  including  the  destination  IP  address,  connection  time 
and  date,  disconnect  time  and  date,  method  of  connection  to  the 
destination  computer,  the  identities  (accoimt  and  screen  names)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such 
connection  information  relates,  and  all  other  information  related  to  the 
connection  from  ISP  or  its  subsidiaries. 

E.  Any  other  records  and  other  evidence  relating  to  the  requested  account.  Such 
records  and  other  evidence  include,  without  limitation,  correspondence  and  other 
records  of  contact  by  any  person  or  entity  about  the  above-referenced  account,  the 
content  and  connection  logs  associated  with  or  relating  to  postings, 
commimications  and  any  other  activities  to  or  through  the  requested  accotmt, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 

If  you  have  any  ouestiops  regarding  this  request,  please  direct  all  inquiries  to 

Iwho  can  be  reached  atP^  I 
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Sincerely, 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 
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U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C,  20535-0001 

ALL  IHFORS-ari™  COI^TTAIHZE 
HSSilH  IS  UMCLJLSSIFIED 
DATE  11~07--2016  BY  J 37 J 8 5134  N3ICE 

August  12,  2015 


Re:  Request  for  Preservation  of  Records 

Pursuant  to  Title  18,  United  States  Code  Section  2703(f),  this  letter  is  a formal  request  for 
the  preservation  of  all  records  and  other  evidence  in  your  possession  regarding  the  domain 
account  @clintoiieinail.com,  pending  further  legal  process. 

You  are  hereby  requested  to  preserve  the  records  described  below  currently  in  your 
possession,  including  records  stored  on  backup  media,  in  a form  that  includes  the  complete 
record,  and  records  that  may  come  into  your  possession  from  the  date  of  acknowledgment  of  this 
request  until  receipt  of  a legal  court  order.  You  are  also  requested  not  to  disclose  the  existence 
of  this  request  to  the  subscriber  or  any  other  person,  other  than  as  necessary  to  comply  with  this 
request,  as  the  FBI's  investigation  may  be  jeopardized  by  this  type  of  disclosure.  You  are  also 
requested  not  to  close  the  account  of  the  subscriber,  unless  requested  to  do  so  by  the  subscriber. 
If  compliance  with  this  request  may  result  in  a permanent  or  temporal  termination  of  service 
to  the  accounts  described  below,  or  otherwise  alert  the  subscriber  or  user  of  these  accounts  as 
to  your  actions  to  preserve  the  referenced  files  and  records,  please  contact  Special  Agent 
as  soon  as  possible  and  before  taking  any  such  actions. 

This  preservation  request  applies  to  the  following  records  and  evidence: 

A.  All  stored  electronic  communications  and  other  files  reflecting  communications  to 
or  from  the  requested  account. 

B.  The  contents  of  any  communication  or  file  stored  by  or  for  the  account  and  any 
associated  accounts,  and  any  information  associated  with  those  communications 
or  files,  such  as  the  source  and  destination  email  addresses  or  IP  addresses, 

C.  All  records  and  other  evidence  relating  to  the  subscriber(s),  customer(s),  account 
holder(s),  or  other  entity(ies)  associated  with  the  requested  account  including, 
without  limitation,  subscriber  names,  user  names,  screen  names  or  other  identities, 
mailing  addresses,  residential  addresses,  business  addresses,  e-mail  addresses  and 
other  contact  information,  telephone  numbers  or  other  subscriber  number  or 


identity,  billing  records,  information  about  the  length  of  service  and  the  types  of 
services  the  subscriber  or  customer  utilized,  and  any  other  identifying 
information,  whether  such  records  or  other  evidence  are  in  electronic  or  other 
form;  and 

D.  All  connection  logs  and  records  of  user  activity  for  the  requested  account, 
including: 

1 . Connection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  Method  of  connection  (e.g.,  telnet,  ftp,  http); 

4.  Data  transfer  volume; 

5.  User  name  associated  with  the  connection  and  other  connection 
information,  including  the  Internet  Protocol  address  of  the  source  of  the 
connection; 

6.  Telephone  caller  identification  records;  and 

7.  Connection  information  for  other  computers  to  which  the  user  of  the 
above-referenced  accounts  connected,  by  any  means,  during  the 
connection  period,  including  the  destination  IP  address,  connection  time 
and  date,  disconnect  time  and  date,  method  of  connection  to  the 
destination  computer,  the  identities  (account  and  screen  names)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such 
connection  information  relates,  and  all  other  information  related  to  the 
connection  from  ISP  or  its  subsidiaries. 

E.  Any  other  records  and  other  evidence  relating  to  the  requested  account.  Such 
records  and  other  evidence  include,  without  limitation,  correspondence  and  other 
records  of  contact  by  any  person  or  entity  about  the  above-referenced  account,  the 
content  and  connection  logs  associated  with  or  relating  to  postings, 
communications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 


Special  Agent 


If  yon  have  any  questions  regarding  this  request,  please  direct  all  inquiries  to 

[ who  can  be  reached  atl 


Sincerely, 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 
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ALL  IlirOKl'iATION  COliTAII-JED 
HEREIN  IS  Ul']CLASSiriEn 


_j_  CATE  11-07““201‘£  EY  .137JS5T3^  N3ICG 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  08/07/2015 


On  August  7 , 2015 , 

Records  Management  Division  provided  the  enclosed 
communications,  classified  SECRET/ /NOFORN, 


for  the  FBI ' s 
internal  FBI 
referencing  three  ( 3 ) 


documents  passed  to  the  FBI  by  the  State  Department  on  or  about  April 
29,  2015.  Insofar  as  the  State  Department  had  identified  FBI  equities 
contained  in  these  documents,  they  were  sent  to  the  FBI  for 
classification  review* 


hS 

hic 


The  first  email,  dated  September  16,  2015  was  found  to  contain  no 
classified  information  and  released  in  full  without  redactions.  The 
second  email , dated  October  17  and  18 , 2012  was  redacted  and  released 
in  part  using  the  B7  (A)  and  B7.{C)  FOIA  exemptions.  The  third  email, 
dated  October  3 , 2012 , was  redacted  and  released  in  part  based  on  the 
B1  FOIA  exemption  insofar  as  it  contained  non-FBI  classified 
information . 


The  enclosure  to  this  record  is  classified  SECRET/ /NOFORN. 


Investigation  on  08/07/201 5 at Washington.  DC. 

Filc^  J I Date  dictated  N/A 
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From: 

Sent: 

To: 

Subject: 

SentinelCaseld: 


(RMD)  {FBI) 


Thursday.  August  06.  2015  3:23  PM 
I rNFHFBI):  [ 


Pocuments#2  — OLGRUT/ZNOFORM 


Classificatio 

Classified  By 
Derived  From: 
Declassify  On^  r. 

TRANSITORY  RECORD 

Please  see  attached. 


0130301 


](LA)(FBI} 


■ffi 

Doc.pdf 
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Classification:  /NOFORN 


1 


Subject: 


kRMD).(FBI) 

^ (CTD)  (FBI) 

l(CTD)(FB[):l 

|[OGC)  {FB()j 

(FBI);  NEAGLE,  LOUISE  M (RMD}(FbI) 
HRC  emails,  FOIA  case  F-201 5-04841  — l 


;^(RMD)  (FBI)I 
](^)(FBI);  JUPlF 


MICHELLE  A (RMD) 
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SentinelCaseld:  TRANSITORY  RECORD 


Classification:  S^RET^NOFORN 

Classified  By:  J23J9W32 

Derived  From:  FBI  NS^,  dated  20120629 

Declassify  On;  204^2^ 

TRANSITORY  RECORD 

I b6 

b7C 

Attached  are  three  new  emails  from  State.  The  review  on  these  three  documents  has  not  been  finalized  by  State,  so  the 
markings  reflect  the  status  at  this  time.  Thanks! 


■ffi  ■ffi 

C05739708,pdf  C05739758.pdf  C0S739635.pcif 


□ 


SentinelCaseld:  TRANSITORY  RECORD 


Classification:  S^RET//NOFORN 

Classified  By:  J23J9^8^2 

Derived  From:  FBI  dated  20120629 

Declassify  On:  204fJl23l\ 


TRANSITORY  RECORD 

Yes,  and  I understand  internally  at  State  there  was  some  who  agreed  with  our  marking. 


Fromil  l(CrDUFBn 

Sent!  Wednesday,  April  29,  2015  6:07  PM 

ToJ  "fRMDl  (FBI)  

Cc:  '^fCrDifFBn:l  l(RMD)  {FBI};|  ^(OGC)  (FBI); 

I ifCTDIfFBH:  JUPINA,  MICHELLE  A {RMD)(FBI);  NEAGLE,  LOUISE  M (RMO)(FBI) 

Subject:  RE:  HRC  emails,  FOIA  case  F-2015-04S41  — SECRET//NOFORN 


Classification:  SECRET //NOFORN 


Classified  By:  F48M57I^ 

Derived  From:  FBI  NS^,  sated  20120629 
Declassify  On:  204pd231 


TRANSITORY  RECORD 

(uCD 

(U)  Thanks,  we'll  take  a look  at  these  and  get  a response  back.  In  glancing  at  the  third  e-maill  notice  it's  been  marked  by 
DOS  as  containing  classified  information.  That  might  in  part  explain  why  the/ve  backed  off  some  of  their  early 
resistance  to  use  invoking  the  bl  exemption. 

(uCD 


From:l  IfRMDl  (FBI) 

Sent:  Wednesday,  April  29,  2015  5:40  PM 

To:l  ^^(CTD)  (FBI)  

Cc:l  lfCTD)fFBI);| l(RMD)  (FB!);!  KOGC)  (FBI); 

I |fCTD)(FBI);  JUPINA,  MICHELLE  A (RMD)(FBI);  NEAGLE,  LOUISE  M {RMD)(FBI) 

Subject:  HRC  emails,  FOIA  case  F-20 15-04841  — 5ECriCT//NOror\M 


1 


From: 

Sent: 

To: 

Cc: 


Subject: 

SentinelCaseld: 


[ 


](RMD)  (FBI) 


Wednesday,  May  06  2015  12:56  PM 
(CTD)  (FBIj 


](OGC)  (FBI);[ 


CECLAS3IFIEC  BY:  HSICG  J37JS5T34 
OH  11“07~201'S 


be 

b7C 


(FBI);  NEAGLE,  LOUISE  M (RMD)(FBI) 

RE;  HRC  emails.  FOIA  case  F-201 5-04841 

TRANSITORY  RECORD 


~3rMD)  (FBI); I , 

J^)(FBI);  JUPINA.  MICHELLE  A (RMD) 


GECRCTffNOrORN 


Classification:  SKCRET/ZNOFORN 

Classified  By:  J23J9^^ 

Derived  From:  FBI  NSI^v  dated  20120629 
Declassify  On:'  2040_)^23P 

TRANSITORY  RECORI 

IZZI 

Do  you  have  the  status?  I need  to  appease  State, 

Thanks 

IZZI 


be 

b7C 


From:[[ 


]RMD)  (FBI) 


Sent:  Wednesday,  April  29,  2015  5:40  PM 
Toj  rCTD) (FBn 


be 

b7C 


Cc:T 


CCTD)(FBI);L 


] (RMD)  (FBI)£; 


(CrD)(FBI);  JUPINA/ MICHELLE  A (RMD)CFBI);  NEAGLE,  LOUISE  M (RMD)(FBI) 


](OGC){FBI); 


Subject:  HRC  emails,  FOIA  case  F-2015-04841  — SECRET//HOFORN 


Classification:  S)5^ET//n6fORN 
Classified  By:  J23J5 

Derived  From;  FBI  NSTtS.^  dated  20120629 
Declassify  On:  2040^23] 


TRANSITORY  RECORI 

zz 

Attached  are  three  new  emails  from  State,  The  review  on  these  three  documents  has  not  been  finalized  by  State,  so  the 
markings  reflect  the  status  at  this  time.  Thanks! 


hS 

hlC 


« File:  C05739708.pdf » « File:  C0573975fi.pdf  » « File:  C05739635,pdf  » 


I 


DZCL^-SSiriEB  BY:  NSICG 
GM  11-07-2D16 


■j31JB5T3^ 


I ~lfRMD)  (FBI) 


From: 

Sent: 

To; 

Cc: 


Subject: 


(RMD)(FBI) 


Friday,  May  08.  2015  1 1 :26  AM 
(CTb){FBr 
DWFBM: 


Iogcxf 


(CT 


(FBI):  NEAGLE.  LOUISE  M (RMD){FBI) 

RE:  HRC  emails.  FOIAcase  F-201 5-04841 


](^)(FbT);  JUPINA,  MICHELLE  a (RMD) 


]{RMD)  (FBI);[ 


OEORETffrjOrORU 


be 

b7C 


SentinelCaseld:  TRANSITORY  RECORD 


Classification 

Classified  By: 
Derived  From: 
Declassify  On: 


TRANSITORY  RECORD 


Thank  you  very  much,  hope  you're  feeling  better. 


From£ 


](CrD)(FBI) 


Sent:  Friday,  May  08,  2015  10:02  AM 
ToH  I (RMD)  (FBI) 

Cc:l  I (CTD)CFBI);|7" 


](RMD)  (FBI);[ 


CTD)CFBI);  JUPINA,  MICHELLE  A {RMD)(FBI):  NEAGLE,  LOUISE  M (RMD)CFBI) 
Subject:  RE:  HRC  emails,  FOIA  case  F-2015-04841  — SCCR[rr//NorORN 


](OGC)(FBI); 


be 

b7C 


Classification:  ^CRET^NOFORN 

Classified  By;  F48['^K72 

Derived  From:  FBIyNSlfev,  dated  20120629 

Declassify  On:  ^,Ef40123l\ 

TRANSITORY  RECORD 

[Ull  I 

(U)  Sorry  for  the  delay  in  getting  back  to  you.  I've  been  out  sick  the  last  couple  days. 

(U)  CTD  is  fine  with  the  redactions  which  DOS  recommends  and  has  no  requests  for  further  redactions. 

I . 


he 

hlC 


(U)  Blessed  are  [hey  who  maintain  fvstsce. 


1 


he 

hlC 


f 

f 

U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C.  20535-0001 


July  21,  2015 

Custodian  of  Records 
Platte  River  Networks 
5700  Washington  Street 
Denver,  CO  80216 


Re:  Request  for  Preservation  of  Records 


Pursuant  to  Title  18,  United  States  Code  Section  2703(f),  this  letter  is  a formal  request  for 
the  preservation  of  all  records  and  other  evidence  in  your  possession  regarding  the  domain 
account  @clin tonemail.com,  pending  further  legal  process. 

You  are  hereby  requested  to  preserve  the  records  described  below  currently  in  your 
possession,  including  records  stored  on  backup  media,  in  a form  that  includes  the  complete 
record,  and  records  that  may  come  into  your  possession  from  the  date  of  acknowledgment  of  this 
request  until  receipt  of  a legal  court  order.  You  are  also  requested  not  to  disclose  the  existence 
of  this  request  to  the  subscriber  or  any  other  person,  other  than  as  necessary  to  comply  with  this 
request,  as  the  FBI’s  investigation  may  be  jeopardized  by  this  type  of  disclosure.  You  are  also 
requested  not  to  close  the  account  of  the  subscriber,  unless  requested  to  do  so  by  the  subscriber. 
If  compliance  with  this  request  may  result  in  a permanent  or  temporary  termination  of  service 
to  the  accounts  described  below,  or  otherwise  alert  the  subscriber  or  user  of  these  accounts  as 
to  your  actions  to  preserve  the  referenced  files  and  records,  please  contact  Special  Agent 
I I as  soon  as  possible  and  before  tedting  any  such  actions. 

This  preservation  request  applies  to  the  following  records  and  evidence: 


A.  All  stored  electronic  communications  and  other  files  reflecting  communications  to 
or  from  the  requested  account. 


B.  The  contents  of  any  communication  or  file  stored  by  or  for  the  account  and  any 
associated  accounts,  and  any  information  associated  with  those  communications 
or  files,  such  as  the  source  and  destination  emai'  ddresj  ;s  or  IF  " :s. 


All  records  and  other  evidence  relating  to  the  si  jCriber(s\  cul^omervjy,  account 
holder(s),  or  other  entity(ies)  associated  with  the  re^i^teu 

Identities, 

idresses,  e-n  Isses  and 

other  contact  information,  telephone  numbers  o:  oAeri 
identity,  billing  records,  information  about  the  length  ^ 


without  limitation,  subscriber  names,  user  names, 
mailing  addresses,  residential  addresses,  busine  s 

o o»( 


b6 

b7C 


services  the  subscriber  or  customer  utilized,  and  any  other  identifying 
information,  whether  such  records  or  other  evidence  are  in  electronic  or  other 
form;  and 

D.  All  connection  logs  and  records  of  user  activity  for  the  requested  account, 
including: 

1 . Connection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  Method  of  connection  (e.g.,  telnet,  ftp,  http); 

4.  Data  transfer  volume; . 

5 . User  name  associated  with  the  connection  and  other  connection 
information,  including  the  Internet  Protocol  address  of  the  source  of  the 
connection; 

6.  Telephone  caller  identification  records;  and 

7.  Connection  information  for  other  computers  to  which  the  user  of  the 
above-referenced  accounts  connected,  by  any  means,  during  the 
connection  period,  including  the  destination  IP  address,  connection  time 
and  date,  disconnect  time  and  date,  method  of  connection  to  the 
destination  computer,  the  identities  (account  and  screen  names)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such 
connection  information  relates,  and  all  other  information  related  to  the 
connection  from  ISP  or  its  subsidiaries. 

E.  Any  other  records  and  other  evidence  relating  to  the  requested  account.  Such 
records  and  other  evidence  include,  without  limitation,  correspondence  and  other 
records  of  contact  by  any  person  or  entity  about  the  above-referenced  account,  the 
content  and  connection  logs  associated  with  or  relating  to  postings, 
communications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 


If  you  have  any  questions  regarding  this  request,  please  direct  all  inquiries  to 


Special  Agent 


who  can  be  reached  at 


Sincerely, 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 


he 

hlC 


ALL  IMFORl-IATICl'I  CONTAlt'JED 

HE.RZIM  IS  Ul'JCLASSIFIZC 

DATE  11-07-201^  3Y  j37JS5TS4  IJSICC 


U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C.  20535-0001 


July  31,  2015 

Joseph  P.  Clancy 
Director 

United  States  Secret  Service 
950  H Street.,  NW 
Washington,  D.C.  20223 


Re:  Request  for  Preservation  of  Records 

Dear  Director  Clancy: 

This  letter  is  a formal  request  for  the  preservation  of  all  records  and  other  evidence  in 
your  possession,  or  in  the  possession  of  Hillary  Clinton,  former  Secretary  of  State,  regarding  the 
domain  account  @clintonemail.com,  pending  further  legal  process. 

You  are  hereby  requested  to  preserve  the  records  described  below  currently  in  your 
possession,  or  in  the  possession  of  Hillary  Clinton,  including  records  stored  on  backup  media,  in 
a form  that  includes  the  complete  record,  and  records  that  may  come  into  your  possession  from 
the  date  of  acknowledgment  of  this  request  until  receipt  of  a legal  court  order.  You  are  also 
requested  not  to  disclose  the  existence  of  this  request,  other  than  as  necessary  to  comply  with  this 
request,  as  the  FBI's  investigation  may  be  jeopardized  by  this  type  of  disclosure. 

This  preservation  request  applies  to  the  following  records  and  evidence: 

A.  All  stored  electronic  communications  and  other  files  reflecting  communications  to 
or  from  the  requested  domain  account. 

B.  All  servers,  computers,  thumbdrives,  hard  drives,  smartphones,  or  any  other 
digital  storage  devices  in  your  possession  or  in  the  possession  of  your  client, 
which  may  contain  communications  to  or  from  the  requested  domain  account. 

C.  All  business  records  and  other  evidence  relating  to  the  establishment  of  the 
domain  referenced  above,  including  subscriber(s),  customer(s),  account 
holder(s),  or  other  entity(ies)  associated  with  the  requested  account  including, 
without  limitation,  subscriber  names,  user  names,  screen  names  or  other  identities, 
mailing  addresses,  residential  addresses,  business  addresses,  e-mail  addresses  and 
other  contact  information,  telephone  numbers  or  other  subscriber  number  or 
identity,  billing  records,  information  about  the  length  of  service  and  the  types  of 


services  the  subscriber  or  customer  utilized,  and  any  other  identifying 
information,  whether  such  records  or  other  evidence  are  in  electronic  or  other 
form;  and 

D.  All  connection  logs  and  records  of  user  activity  for  the  requested  account, 
including: 

1 . Connection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  Method  of  connection  (e.g.,  telnet,  ftp,  http); 

4.  Data  transfer  volume; 

5.  User  name  associated  with  the  connection  and  other  connection 
information,  including  the  Internet  Protocol  address  of  the  source  of  the 
connection; 

6.  Telephone  caller  identification  records;  and 

7.  Connection  information  for  other  computers  to  which  the  user  of  the 
above-referenced  accounts  connected,  by  any  means,  during  the 
connection  period,  including  the  destination  IP  address,  coimection  time 
and  date,  disconnect  time  and  date,  method  of  connection  to  the 
destination  computer,  the  identities  (account  and  screen  names)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such 
connection  information  relates,  and  all  other  information  related  to  the 
connection  from  ISP  or  its  subsidiaries. 

E.  Any  other  business  records  and  other  evidence  relating  to  the  requested  account. 
Such  records  and  other  evidence  include,  without  limitation,  correspondence  and 
other  records  of  contact  by  any  person  or  entity  about  the  above-referenced 
account,  the  content  and  connection  logs  associated  with  or  relating  to  postings, 
communications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 


Special  Agent 


If  you  have  any  questions  regarding  this  request,  please  direct  all  inquiries  to 


Kvho  can  be  reached  afl 


Sincerely, 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 
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WASHINGTON.  OC 
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August  5,  2015 

VIA  ELECTRONIC  TRANSMISSION 


The  Honorable  James  B.  Comey,  Jr. 

Director 

Federal  Bureau  of  Investigation 
935  Pennsylvania  Avenue,  NW 
Washington,  D.C.  20535 

Dear  Mr.  Comey: 

The  Judiciary  Committee  has  learned  that  the  Office  of  Inspector  General  for  the 
Department  of  State  (State  OIG)  opened  an  investigation  involving  potential  criminal  conduct  by 
Ms.  Huma  Abedin  while  she  worked  for  the  Department  of  State  under  then -Secretary  Clinton. 
Specifically,  the  investigation  examined  the  circumstances  of  Ms.  Abedin’s  work  arrangements, 
leave  status,  and  conversion  from  a full-time  Department  of  State  employee  to  a Special 
Government  Employee  (SGE)  and  Senior  Advisor  to  former  Secretary  Clinton. 

During  the  course  of  its  investigation  into  this  matter,  the  Committee  has  learned  that  the 
State  OIG  transmitted  a letter,  notice,  or  other  similar  communication  (“letter”)  to  the  FBI  in 
October  2013  placing  it  on  notice  that  State  OIG’s  investigation  was  no  longer  a preliminary 
matter  but  a full-fledged  criminal  investigation  into  Ms.  Abedin.  However,  there  have  been 
public  denials  that  the  information  provided  to  the  Committee  is  accurate, ' In  order  for  the 
Committee  to  assess  the  veracity  of  the  information  provided  in  this  matter,  please  provide  a 
copy  of  the  October  2013  letter  from  State  OIG  by  no  later  August  12, 201 5.  If  no  such  letter 
exists,  please  advise  the  Committee  immediately. 

If  you  have  any  questions,  contact  Josh  Flynn-Brown  of  my  Committee  Staff  at  (202)  224- 
5225.  Thank  you  for  your  cooperation. 


Sincerely, 

Charles  E*  Grassley 
Chairman 

Committee  on  the  Judiciary 


' S.A,  Miller,  "Hillary  Clinton  aide  Huma  Abedin  emerges  as  potential  liability  for  20 16  bid,”  WASHINGTON  Times  (August  4, 
2015),  Accessible  at  http://www,washingtontinics,corn/ncws/20l  5/aug/4/hillary-clinton-aidc-huma-abcdin-cmergcs-as-potcnt/ 
("^Thcre  is  no  criminal  investigation,  and  there  never  has  been.  To  say  otherwise  is  patently  false  and  grossly  irresponsible,'  [Ms, 
Abedin's  attorney,  Karen  L.  Dunn]  said/') 


FD-302a(Rev.  10-6-95) 
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ALL  IHrOCRiiATICaH  Ca^TAINED 
HEREIH  IS  UWCLASSiriSC 

-1-  DATE  11-07-201'5  3Y  J37J85T94  NSICG 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  07/3 1/2015 


On  07/31/2015,  at  approximately  12:45  p.m.,  Special  Agend 
letter  addressed  to  Joseph  P,  Clancy,  Director,  U.S,  Secret  Service  t^ 
Secret  Service. 


served  a preservation 

lu.s. 


he 

hlC 


The  preservation  letter  was  served  at  U.S.  Secret  Service’s  office  located  at  950  H.  Street,  NW, 
Washington.  DC  20223.1  brovided  his  contact  information  as  phone: 


b6 

b7C 


Investigation  on  07/31/2015 
File# 


at_ 


Washington. 
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By  SA^ 


This  document  contains  neither  recommendations  nor  < ms  of  th< 

and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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b7C 


operty  of  the  FBI  and  is  loaned  to  your  agency; 


r 
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U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C.  20535-0001 


Date : 
To: 


From: 


August  4,  2015 

Steve  A.  Linick 
Inspector  General 
Department  of  State 

Charles  H.  Kable 
Section  Chief 
Counterespionage  Section 
Counterintelligence  Division 


JLLL  IHrorajJ.TIDH  COHTAIl-JED 

HEREIM  IS  UHCLASSIFIEC 

CATE  11-D7“201'S  BY  l'37J85T3>J  H3ICG 

1 


Subject:  Request  for  copies  of  Preserved 


bVE 


On  July  6,  2015,  the  FBI  received  a Section  811(c)  Referral  from  the 
Inspector  General  of  the  Intelligence  Community  regarding  the  potential 
compromise  of  classified  information.  Pursuant  to  this  referral,  FBI 
respectfully  requests  [ Ifor 

the  following 


b6 

b7C 

b7E 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your 
agency;  it  and  its  contents  are  not  to  be  distributed  outside  your  agency. 


2 
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20, 

21 

22 

23, 


You  are  also  requested  not  to  disclose  the  existence  of  this  request , other  than  as  necessary  to  comply 
with  this  request,  as  the  FBI's  investigation  may  be  jeopardized  by  this  type  of  disclosure. 

If  you  have  any  questions  regarding  this  request,  please  direct  all  inquiries  to  Special  Agent 

who  can  be  reached  at 

1 I 1 b7C 


Sincerely, 


Charles  H.  KablelV 
Section  Chief 

Counterintelligence  Division 


♦♦ 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your 
agency;  it  and  its  contents  are  not  to  be  distributed  outside  your  agency. 


//HOFOBH 


s: 


To : 
Re : 


CD-4 From: 

{U)  


CD-4 
Date : 


08/05/2015 


FBI  INFO. 

GLIL3SIFIED  BY:  HSICG  J37J85T34 
REA3DW:  1.4  (C) 

BECLASSin,'  ai:  12-31-2040 
DATE:  11-03-2016 
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Precedence : ROUT I NE 


Date:  08/05/2015 


To:  CD-4f  Counterespionage  Section 

From:  CD-4 ^ Counterespionage  Section 


Contact:  A/ASC 

Approved  By: 

5 

Drafted  By: 

Case  ID  #:  (U)  | 

ym~ 

Title:  {S/Z^ttf^ 


Synopsis:  ( U / / FOUO ) To  document  meeting  with  the  US  Secret 
Service  on  07/28/2015. 

C las  s i f ied'^.^yj^.'C^WS  3B3  0 

Derived  Fro^<^I  HSIC  dated  20130301 

Declassify  On:  20401231 
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bVC 


bl 
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b7E 


Enclosure (s> : (U/ /FOUO]  One  original  copy  of  notes  taken  by 

Counterespionage  Section  {CD-4)  Section  Chief  Charles  Kable  IV; 
one  original  copy  of  notes  taken  by  CD-4  A/ASCf  I 


^ one  original  business  card  from  US  Secret  Service  (USSS) 

Inspector | | 


Details:  {U//F0U0)  On  06/28/2015,  CD-4  SC  Kable  and  A/ASC 

met  with  the  USSS  Office  of  Inspections.  Acting  Special  Agent  in 
Charge,  Inspectorl  I and  Deputy  Special  Agent 

in  Charge,  Inspectorl  I at  USSS  Headquarters, 

950  H St.  NW,  Washington,  DC  20223. 


r I and  I 

regarding  their  obligation  to  not 
investigation  and  voluntarily 
acknowledgement  forms.  CD-4  requested 
assistance  in  obtaining  USSS  information 
location,  operation,  and  USSS 
personal  e-mail 


1 were  admonished 
further  discuss  the  FBI's 
executed  sensitive  case  briefing 

and  [ 


related  to  rhp 
involvement  with  the 
network/server . CD-4  also  requested — tneit 


iS] 
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bl 

b3 
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/■MOrOIUT 


1 


To:  CD-4 

Re:  (U)  r 


,T//»0F01ttI 


From:  CD-4 

iDate:  08/05/2015 


assistance  in  identifying 
interviewed  as  part  of  the 


S personnel  to  be 
nvestigation. 


acknowledged  that  he  understood  the 

FBI's  request,  but  advised  that  he  would  need  to  confer  with  his 
management  given  that  the  request  dealt  with  the  USSS  protectee 

mission.  advised  he  would  only  generally  inform  his 

management  of  the  type  of  information  the  FBI  was  seeking  and 
would  not  identify  to  his  management  the  specific  subject  or 
details  of  thel  linvestiaation.  1"  1 left  the 

meeting  to  confer  with  unidentified  USSS  managers  and  indicated 
he  would  return  to  the  meeting  room  with  a response. 


■ (S2>^^F)  Approximately  20  minutes  later,  | | 

returned  to-^h^meeting  room  and  advised  that  he  had  conferred 
with  his  management  chain.  ^ advised  that  his  management 

told  him  that  any  FBI  request  for  information  or  assistance 
related  to  this  matter  would  need  to  come  via  written  request 
from  the  Department  of  Justice  to  the  Department  of  Homeland 
Security,  which  would  then  forward  the  request  to  the  USSS.  When 
asked,  [refused  to  identify  the  specific  USSS  manager fsl 

to  whom  he  spoke.  CD-4  advisedi  I and  j that ^ as 

the  only  two  USSS  officials  read-in  to  the 

investigation,  they  were  not  permitted  to  <Lj-3cujj — luc  cATTrtence 
of  the  FBI's  investigation  with  anyone -j  andj  | 

indicated  they  understood  their  obligation  to  protect  the 
investigation. 


T//MOFODN 


2 


FD-302a(Rev.  10-6-95) 


ALL  IHrOFilATi™  COITTAII'IEL 
HZRZIM  IS  miCLASSIFIED 
-1-  date  ll““a7“2D:6  EY  J37JB5TS4  NSICG 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  08/14/2015 


On  08/14/2015.  Special  Agent 
records  to 


[provided  (1)  Disc  containing  30,  542  email 

]Office  of  the  Inspector  General  of  the  Intelligence  Community. 


he 

hic 


Jwas  also  provided  a letter  signed  on  08/13/2015  from  Randall  C.  Coleman,  Assistant  Director 


to  L Charles  McCullough  III  which  outlined  the  guidelines  for  the  release  of  the  Disc. 


Investigation  on  08/14/2015 

File#  J I 


at  Washington,  DC 

Date  dictated  N/A 


BySA^ 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI,  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


b3 

b7E 


b6 

bVC 


FD- 1 087  (Rev  5-8-10) 


//HOFORW 

BUREAU  OF  INVESTIGATION 

Colleoted  Hem  Log 


OpriciAL  Record  ' 


tSi 

Event  Title: 
Approved  By : 


Date:  08/14/2015 


bl 

b3 

b7E 


he 

hlC 


Drafted  By: 


Case  ID 


MISHANDLING  OF  CLASSIFIED; 

UNKNOWN  SUBJECT  OR  COUNTRY; 

SENSITIVE  INVESTIGATIVE  MATTER  (SIM) 


bl 

b3 

b7E 


Rea^K.^: 

Derive^<Trom:  Multiple 
Sources 

De^assify^;  20401231 
Full  Investigation  Initiated:  07/10/2015 


CLASSIFIED  BY:  HSICC  J37JS5T54 
jt^SON:  1.4  (C) 

DECLASSII”f  CUT:  12-31-2040 
DATE:  11-07-2015 

ALL  INFORMATION  COIJTAirLED 
HEREIN  IS  ULTCLASSIFIED  EXCEPT 
WHE.KE  SBCr^’iV  GTHZRv/ISE 


Collected  From:  (U)  KATHERINE  TURNER,  ESQ 
WILLIAMS  & CONNOLLY,  LLP 
725  12TH  STREET,  NW 
WASHINGTON,  District  Of  Columbia 

f 

Receipt  Given?:  No 


Holding  Office:  WASHINGTON  FIELD 


Details:  No  Details  Provided 

Item  Type  Description 

IB  General  (U)  BOX  OF  EMAIL  PAPER  DOCUMENTS. 

BOX  2 

Collected  On:  08/06/2015 

Seizing  Individual:  | ~ 

Collected  By:  | 

Location  Area:  NA 
Specific  Location:  NA 


b6 

b7C 


"§^gg[^//WOFOTU 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI  It  is  the  propeny  of  the  FBI  and  is  loaned  to  your  agency;  it  and  its 
contents  arc  not  to  be  distributed  outside  your  agency. 


Title: 
Re : r 


/ /WOFORN 


bl 

b3 

b7E 


08/14/2015 


IB  General 


IB  General 


IB  General 


IB  General 


IB  General 


(U)  BOX  OF  EMAIL  PAPER  DOCUMENTS. 
BOX  4 


Collected  On:  08/06/2015 
Seizing  Indivi(jiual : 
Collected  By; 

Location  Area: 


NA 


Specific  Location: 


NA 


(U)  BOX  OF  EMAIL  PAPER  DOCUMENTS. 
BOX  5 

Collected  On:  08/06/2015 

Seizing  Individual:  I 

Collected  By:  | 

Location  Area:  NA 
Specific  Location:  NA 


(U)  BOX  OF  EMAIL  PAPER  DOCUMENTS, 
BOX  7 

Collected  On:  08/06/2015 

Seizing  Individual:  I 

Collected  By:  

Location  Area:  NA 
Specific  Location:  NA 

(U)  BOX  OF  EMAIL  PAPER  DOCUMENTS. 
BOX  9 

Collected  On:  08706/2015 

Seizing  Individual:  | 

Collected  By:  | [ 

Location  Area:  NA 
Specific  Location:  NA 


(U)  BOX  OF  EMAIL  PAPER  DOCUMENTS. 
BOX  10 


Collected  On:  08/06/2015 


Collected  By: 
Location  Area: 


dual : 

NA 


Specific  Location: 


NA 


hS 

hlC 


h6 

hlC 


hS 

b7C 


b6 

b7C 


b6 

b7C 


iSi 

Title: 
Re:  I 


sfepK^ 


T//HOFOnW 


08/14/2015 


bl 

b3 

b7E 


IB  General  (U)  BOX  OF  EMAIL  PAPER  DOCUMENTS. 

BOX  11 

Collected  On;  08/06/2015 
Seizing  Individual : | 

Collected  By : 

Location  Area:  NA 
Specific  Location:  NA 

IB  General  (U)  BOX  OF  EMAIL  PAPER  DOCUMENTS. 

BOX  16 

Collected  On:  08/0  6/2015 

Seizing  Individual : | 

Collected  By: 

Location  Area:  NA 
Specific  Location:  NA 

IB  General  (U}  BOX  OF  EMAIL  PAPER  DOCUMENTS. 

BOX  2 0 

Collected  On;  08/ 06/2015 

Seizing  Individual : | 

Collected  By;  | [ 

Location  Area:  NA 
Specific  Location:  NA 


hS 

hlC 


hS 

hlC 


hS 

hlC 


♦ ♦ 


s: 


fT//HOFOraT 
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FEDERAL  BUREAU  OF  INVESTIGATION 
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FD-302a(Rev,  10-6-95) 


A,LL  IHrOSi-JATIOn  COHTAIl-JED 

HEREIM  IS  UWCLASSIFIEC 

CATE  11-0S--201'S  BY  JTSJISTSO  HSICG 


-1- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  08/03/201 5 


On  August  3,  2015, 


Records 


Management  Division,  Records  Information  and  Dissemination  Section, 
Winchester,  Virginia  provided  the  enclosed  internal  email 
communications  referencing  the  FBI's  classification  of  a Movember  18 , 
2012  State  Department  email.  The  enclosure  was  provided  by  I I in 

support  of  statements  made  during  a July  30,  2 015  FBI  interview  and 

documents  items  diseased  at  that  time.  The  enclosure  has  an  overall 
classification  of  / NO FORM . 


b6 

b7C 


Investigation  on  Q8/03/20I5 
File#  J L 


at 


Washington,  D,C- 

Date  dictated  N/A 


b3 

b7E 


By  ^ 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI. 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


b6 

bVC 


It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  il 


0 


ALL  INFOx^£ATICI-f  Ca^TAIl-JED 

HEREIN  IS  UiaCLASSIFIED 

CATE  ll“03“201#i  BY  J7ftJ18T8Q  NS  ICG 


FD^302a{Rev.  10-6-95) 


-1- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  07/31/2015 


On  July  31;  2015  receptionist  at  Williams  and 

Connelly  LLP,  accepted  a preservation  letter  on  behalf  of  Kathleen 
Turner  to  preserve  records  and  electronic  media  related  to  the 
©clintonemail , com  email  server. 


b6 

b7C 


Investigation  on  07/31/2015 at Washington,  DC 




b3 

b7E 


File^ 


Date  dictated  N/A 


BySA^ 


b6 

b7C 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI , It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  ij 
and  its  contents  are  not  to  be  distributed  outside  your  agency, 

• 

4/.A  s? 


ALL  INFORI-iATIGlI  COWT AIMED 
HEREIN  IS  UMCLASSiriED  E>:CEPT 
VmEKE  SHCn'*!-!  OTHERV^SE 


KD- 1087  (Rev  5-8-10) 


• CLASSIFIED  RV:  N5ICG  .17^J18T80 
REASai:  1.^  (C^ 

DECLASSIFY  OH;  12-31-2040 
CATE:  ll-DS-2016 


T//HOFOniif 


OFFtciAL  Record 

*'  «“'»  l>c^'  « 

cKtr^  ffi:  li'vm’itoA 


FEDERAL  BUREAU  OF  INVESTIGATION 


Collected  Item  Log 


Event  Title: 


X 


'Si 


Date:  08/14/2015 


bl 

b3 

b7E 


Approved  By : 


Drafted 


Case  ID 


{S//W€’)|  I 

MISHANDLING  OF  CLASSIFIED; 
UNKNOWN  SUBJECT  OR  COUNTRY; 
SENSITIVE  INVESTIGATIVE  MATTER 


(SIM) 


b6 

b7C 


bl 

b3 

b7E 


Full  Investigation  Initiated:  07/10/2015 


Collected  From:  (U)  Katherine  Turner,  Esq 
williams  & Connolly,  LLP 
725  12th  Street,  NW 
Washington,  District  Of  Columbia 

Receipt  Given? : No 

Holding  Office:  WASHINGTON  FIELD 


Details : 


No  Details  Provided 


Item  Type  Description 

IB  General  (U)  Box  of  Paper  Documents  - Email  - Box  19 

Collected  On:  08/06/2015 

Seizing  Individual:  F | 

Collected  By: 

Location  Area: • NA 
Specific  Location;  Na 


b6 

b7C 


Thiiv  docun^ent  contains  neither  recommendations  nor  conclusions  of  the  FBJ  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agenev,  it  and  its 
contents  are  not  to  be  distributed  outside  your  agency 


SgStarZ/HOFORN 


Title: 

X 

iS 

Re: 

08/14/2015 

bl 

b3 

b7E 


IB  General 


IB  General 


IB  General 


IB  General 


IB  General 


IB  General 


(U)  Box  of  Paper  Documents  - Email  - Box  Box  3 

Collected  On:  08/06/2015 

Seizing  Individual : | 

Collected  By:  | | 

Location  Area : NA 
Specific  Location:  NA 


(U)  Box  of  Paper  Documents  - Email 
Collected  On:  08/06/2015 
Seizing  Individual : 

Collected  By: 

Location  Area : 


Box  18 


Specific  Location : 


NA 


(U)  Box  of  Paper  Documents  - Email  - Box  22 

Collected  On:  08/06/2015 

Seizing  Individual : | ~| 

Collected  By: . 

Location  Area:  NA 
Specific  Location : NA 


(U)  Box  of  Paper  Documents  - Email  - Box  14 

Collected  On:  08/06/2015 

Seizing  Individual : [ I 

Collected  By: 

Location  Area:  NA 
Specific  Location:  NA 


(U)  Box  of  Paper  Documents  - Email  - Box  21 

Collected  On:  08/06/2015 

Seizing  Individual : | | 

Collected  By:  | 

Location  Area:  NA 
Specific  Location:  NA 


[U)  Box  of  Paper  Documents  - Email  - Box  1 
Collected  On:  08/06/2015 
Seizing  Individual : | 

Collected  By: 

Location  Area : NA 
Specific  Location:  NA 


b6 

b7C 


b6 

b7C 


b6 

b7C 


b6 

b7C 


b6 

b7C 


b6 

b7C 


2 


Title: 

C 


X 


Re: 


T//HOFORN 


08/14/2015 


bl 

b3 

b7E 


IB  General 


IB  General 


IB  General 


IB  General 


IB  General 


(U)  Box  of  Paper  Documents  - Email  - Box  12 

Collected  On:  08/06/2015 

Seizing  Individual : 

Collected  By: 

Location  Area : ^ WK 
Specific  Location:  NA 

(U)  Box  of  Paper  Documents  - Email  ^ Box  17 

Collected  On:  08/06/2015 

Seizing  Individual:  I ~ 

Collected  By: 

Location  Area:  NA 
Specific  Location:  NA 

(U)  Box  of  Paper  Documents  “ Email  - Box  6 

Collected  On:  08/06/2015 

Seizing  Individual : I ~ 

Collected  By: 

Location  Area:  NA 
Specific  Location:  NA 

(U)  Box  of  Paper  Documents  - Email  - Box  8 

Collected  On : 0 8/0 6/2015 

Seizing  Individual : | 

Collected  By: 

Location  Area:  NA 
Specific  Location:  NA 

(U)  Box  of  Paper  Documents  - Email  - Box  15 
Collected  On:  08/06/2015 
Seizing  Individual : I | 

Collected  By: 

Location  Area:  WA 
Specific  Location:  NA 


b6 

b7C 


b6 

b7C 


b6 

b7C 


b6 

b7C 


b6 

b7C 


!T//MOFOBH 


3 


/WOFORM 


Title 
Re:  r 


^ 

08/14/2015 


'Si 


bl 

b3 

b7E 


IB  General  (U)  Box  of  Paper  Documents  - Email  - Box  13 

Collected  On:  08/06/2015 

Seizing  Individual : | | 

Collected  By: 

Location  Area ; NA 
Specific  Location:  NA 


b6 

b7C 


♦ ♦ 
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ALL  IMFOKilATIOW  COr'TTAIl'ISE 

HEREIN  IS  UNCLASSIFIED 

DATE  11-03-2016  BV  J76JieT80  HSICG 


-1- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  08/13/2015 


On  August  12,  2015, 


of  Platte  River  Networks, 


5700  Washington  St,  Denver,  CO  80216,  met  with  Agents  of  the  FBI  at 
the  Equinix  facility  located  at  800  Secaucus  Road,  Secaucus,  NJ  07094, 
to  turn  over  to  the  FBI  a computer  server  used  to  host  the  email 
system  for  former  Secretary  of  State  Hillary  Clinton's 
©Clint onemail . com  Internet  domain. 


At  approximately  4; 00PM, 


met  Agents  and  one  CART 


Forensic  Examiner  at  the  parking  lot  of  Equinix  (the  collocation 
facility  where  the  server  was  physically  located  and  operated  from) 
and  transferred  one  (l)  Dell  Poweredge  server  to  the  FBI's  possession 
described  in  detail  below  and  on  the  enclosed  FD-941,  Consent  to 
Search  Computers,  and  FD-597,  Receipt  for  Property. 

Item  1;  Dell  Poweredge  2900,  gray  color,  S/N  G842PC1 


signed  the  enclosed  FD-941,  Consent 


Prior  to  departing,  | 
to  Search  Computers,  and  FD-597,  Receipt  for  Property.  The  original 
was  kept  by  the  FBI  and  copies  were  made  by 


for  his  records . 


b6 

b7C 


b6 

b7C 


b6 

b7C 


Subsequent  to  the  FBI's  collection  of  the  above,  Item  1 was 
entered  into  evidence,  and  given  a IB  number  by  the  Washington  Field 
Office,  and  then  transported  to  the  FBI's  Forensic  Analysis  Unit  in 
Quant ico,  Virginia  for  storage  and  evaluation.  Copies  of  the  intake 
sheets  and  FD-1004  are  enclosed  with  this  communication. 


Investigation  on  08/12/2015 


at 


File# 


Secaucus.  NJ 


Date  dictated  N/A 


b3 

b7E 


FD-192 

Revised 

01/09/2009 


CLASSIFIEIt  BY:  HSICG  J7€J1STSD 
^ BE.i^SOI-a:  1.4  {C> 

m DECLASSirV  Ql^:  12-31-2040 

DATE:  ll-09-201<6 

FEDERAL  BUREAU  OF  INVESTIGATION  ALL  INFQRIviATION  Cal^rTAIl^EC 
EVIDENCE  DATA-LOADING  FORM  hsreim  is  uuciassi-iee  e/xeit 

.ifflERE  SHdpfN  OTHERVilSE 


Sep^urate  forms  are  mandat ory  for  evidence  seized  on  different  dates,  at  different  locations,  by  different  individuals,  for  different 
types  of  evidence.  


Type  of  Evidence  being  submitted: 

□ General  Evidence  D Firearms 

113  Valuable  Evidence  D Weapons 

□ Evidence  Purchase  Money  □ Other 

□ Drug  Evidence  D FGJ 

31  CART 


Warning  - special  handling 

□ Body  Fluids  O Other 

□ Whole  Blood  

□ HA2MAT 

Q Refrigeration  D Enviro- 


Title  and  Character  of  Case: 


iS; 

Person  Acouiring  Evidence: 

Date  Acquired: 

SM 

Time  Aqjui  red: 

if 


Source  from  which  evidence  acquired: 
[Person’s  name/job  title/company/address] 


TiAnS.  y fth  , *j:S' 

Anticipated  Disposition:  . 1 Forfeiture  Potential:  ^ ' p;;pferal  Taxpayer  Information: 

Q^es  □ No  , ; □ Yes  □ No 


Sealed  By:  [printed  name] 


Estimated  Dollar  Value: 


Witnessed- Byi/,  [printed  name] 


Total  D^g  Package  Weight: 


Complete  Description  (Plca^Pfiridt) J •. 

. -r'” 


:ljlssified  EY:  nsicg 


:76J1!3T80 


KZASOW;  1.4  (C;* 

DECLASSIFY  OT : 12-31-2040 


DATE:  11-05-2016 


DeteHs 

Case'. 

Description:  (U)  Dell  Poweredge  2900 

Submitted) 


Item:  1B3 

0„,  color,  S/»  <3«<2fa  >0»W 


b7E 


b3 

b7E 


Collected  On:  08/12/2015  04:10  PM  EST  l^^ndllng: 

Receipt  Item  l^one  Hazardous  Waterlals: 

CATS  ID#:  i^one 

FBI  Seizure  #:  None  Abandonment  #: 


C ATS  Aba ndo nm ent 


None 

None 

None 


ALL  II^FORi-iATIOM  CONTAINED 
HERE  113  IS  UITCLASSiriED  EXCEPT 
WHERE  SHQ^iia  DTHEKvaSE 


Digital  Informalion 

Type:  Computer 
Serial  Number:  G842PC1 
Batteries  Charged;  No 

Number  Collected:  1 
Collected  by  CART:  NO 


Discovery  Location 

f 

^ Others  Agency: 

b6 

Seizing  Individual:^ 
Specific: 

NA 

1 Othem:  None 

b7C 

Wone 


Anticipated  Disposition 

None 


on  None 


Storage  Information 

Holding  Office: 


V3ASHINGTON 


field 


Finalized  By: 


Location:  E1167159  - ECRl , MAIN 


Last  inventory:  None 

evidence  control  center  (B112)  WI«  HQ 


Barcorio#:  £5490158 


Chain  of  Custody 
Shipping  f Transfer  log 


hS 

b7C 


History 


Acqutdtitin  Event  ixtolls 
Acquisition  Event: 

Collected  From: 


X 


(Si 


(U)  Platte  River  Wetwotks/Equine 
800  Secaucus  Rd 
Secaucus,  New  Jersey, 


07094 


X 


Receipt  Given:  No 

Holding  Office:  WASHINGTON  FIELD 


Evidence  Log:  I 

fierral  28 


bl 

b3 

b7E 


b3 

b7E 


a 


8/12/2015  4:5 


ALL  IHrORI'dA^TIGU  CG1-ITAI>JED 
HEREIII  13  Ul'lCLASSiriZD 


FD-597  (Rev.  4-13-2015) 


CATE  il“0S'““2015  3Y  .T'^SJISTSO  N3ICG 


of  1 


Case  ID: 


UNITED  STATES  DEPARTMENT  OF  JUSTICE 

FEDERAL  BUREAU  OF  INVESTIGATION 

Receipt  for  Property 


On  (date)  08/12/2015 


item  (s)  listed  below  were: 
m Collected/Seized 
n Received  From 
n Returned  To 
□ Released  To 


b3 

b7E 


(Name)  P^^tte  River  Networks 

(Street  Address)  Equinix:  800  Secaucus  Road 

(City)  SecaucuSj  NJ  07094 


Description  of  Item  (s): 


CT7 


ALL  INFOKI-LATICI'f  Ca^TAIl-JED 
IS  ™CLASSIFIEC 

CATE  11-03-201^  BY  JT^JISTSD  NSICG 

CONSENT  TO  SEARCH  COMPUTER(S) 


have  been  asked  by  Special  Agents  of  the 


Federal  Bureau  of  Investigation  (FBI)  to  permit  a complete  search  by  the  FBI  or  its  designees  of  any  and  all  computers, 


FD-941  (2-26-01) 


any  electronic  and/or  optical  data  storage  and/or  retrieval  system  or  medium,  and  any  related  computer  peripherals, 
described  below: 

CPU  Make,  Model  & Serial  Number  (if  ^w^able) 


Storage  or  Retrieval  Media,  Computer  Peripherals 


and  located  at  800  Secaucus  Road,  Secaucus  NJ  Q7Q94  ' which  I own,  possess 

control,  and/or  have  access  to,  for  any  evidence  of  a crime  or  other  violation  of  the  law.  The  required  passwords,  logins, 

and/or  specific  directions  for  computer  entry  are  as  toHows:  — _ — , _ — _ _ — ^ ■ 

1 have  been  advised  of  my  right  to  refuse  to  consent  to  this  search,  and  1 give  permission  for  this  search,  freely 

and  voluntarily,  and  not  as  the  result  of  threats  or  promises  of  any  kind, 

1 authorise  those  Agents  to  take  any  evidence  discovered  during  this  search,  together  with  the  medium  in/on  which 

it  is  stored,  and  any  associated  data,  hardware,  software  and  computer  peripherals, ^ 

August  12,  2015 ^ - 

Date 

August  12,  2015  

Date  ^ 

Special  Agent ^ 

Printed  Full  Name  of  Witness 

Secaucus,  NJ 


computer  peripherals. 


Location 
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COMMITTEE  ON 

HOMELAND  SECURITY  AND  GOVERNMENTAL  AFFAIRS 
WASHINGTON,  DC  20510-6250 

August  17,  2015 


The  Honorable  James  B>  Comey 
Director 

Federal  Bureau  of  .Investigation 
935  Pennsylvania  Avenue,  NW 
Washington,  D.C,  20535 

Dear  Director  Comey: 

I write  to  inquire  about  recent  reports  that  the  Federal  Bureau  of  Investigation  (FBI)  has 
taken  possession  of  a personal  email  server  and  athumb  drive  containing  30,000  emails  sent  or 
received  by  former  Secretary  of  State  Hillary  Clinton  that  may  include  classified  information. 
According  to  the  Inspector  General  for  the  Intelligence  Community  (IC  IG),  the  emails  contained 
on  the  thumb  drive  and  transmitted  on  the  personal  server  include  national  security  information 
collaterally  classified  as  high  as  Top  Secret  and  subject  to  Sensitive  Compartmented  Information 
control  systems,  which  are  reserved  for  the  country’s  most  sensitive  intelligence.^  As  the  FBI 
begins  to  examine  the  thumb  drive  and  server,  I seek  to  understand  what  steps  you  have  taken  to 
review  the  material  and  to  evaluate  the  safeguards  surrounding  the  classified  information. 

On  March  12,  2015, 1 joined  Chairman  Bob  Corker  and  Chairman  Richard  Burr  in  asking 
the  Inspector  General  of  the  State  Department  to  examine  whether  State  Department  employees 
Sent  or  received  classified  information  in  an  insecure  manner.^  We  asked  that  the  State 
Department  IG  coordinate  with  the  IG  IG  in  this  review.'*  On  March  18,2015,1  wrote  separately 
to  the  State  Department  IG  to  inquire  whether  Secretary  Clinton’s  personal  emails  included  any 
classified  information.^  On  July  23,  2015,  the  IC  IG  notified  Congress  that  its  limited  sampling 
of  a portion  of  Secretary  Clinton’s  emails  had  revealed  the  presence  of  classified  information,^ 
The  IC  IG  referred  the  matter  to  the  FBI.’  . 


‘ See  Michae]  S,  Schmidt,  Hillary  Clinton  directs  aides  to  give  email  server  and  thumb  drive  to  Justice  Department, 
N.Y.  Times,  Aug.  1 1,  2015;  Tom  Hamburger  &,  Karen  Tumulty,  Hillary  Clinton's  e-mail  server  turned  over  to  FBI, 
Wash.  Post,  Aug.  1 2,  20 15 . 

^ Memorandum  for  Sen,  Richard  Burr  et  al.  from  I.  Charles  McCullou^,  III,  Update  Classified  Material  on  Personal 
Electronic  Storage  Devices  (Aug.  1 1,  2015). 

^ iSee  Letter  from  Senator  Bob  Corker  et  al,  to  U.S.  Dep’t  of  State.  Office  of  Inspector  Gen.  (Mar.  12,  20 1 5). 

* Id. 

* Letter  from  Senator  Ron  Johnson,  S.  Comm,  on  Homeland  Sec.  & Gov’t  Affairs,  to  Steve  A.  Linick,  U.S.  Dep’t  of 
State  Office  of  Inspector  Gen.  (Mar.  1 8,  20 1 5), 

“ Memorandum  for  Sen.  Richard  Burr  et  al.  from  I.  Charles  McCullough,  III,  Update  to  IC  IG  support  to  State 
Department, IG  (July  23, 2015).  The  1C  IG  and  State  Department  IG  later  clarified  that  the  “emails  contained 
classified  information  when  they  were  generated  and,  according  to  IC  classification  officials,  that  information 
remains  classified  today.”  t.  Charles  McCullough,  III,  &.  Steve  Linick,  Statement  from  the  Inspectors  General  of  the 
Intelligence  Community  and  the  Department  of  State  Regarding  the  Review  of  Former  Secretary  Clinton’s  Emails 
(July  24, 2015). 

^ Memorandum,  supra  note  6. 
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On  August  11,  2015,  the  IC IG  notified  Congress  that  Secretary  Clinton’s  emails 
included  “information  classified  up  to  ‘TOP  SECRET//SI//TK//NOFORN.’”®  The  same  day,  the 
New  York  Times  reported  that  Secretary  Clinton  surrendered  the  email  server  and  thumb  drive 
containing  the  emails  to  the  FBI,  including  at  least  two  emails  containing  Top  Secret 
information  ® Reports  have  also  suggested  that  data  may  have  been  deleted  from  the  server  prior 
to  its  transfer  to  the  FBI,  but  that  back-up  servers  may  exist  and  that  deleted  information  on  the 
server  may  be  recoverable. These  reports  raise  questions  about  the  steps  taken  to  retrieve, 
preserve,  and  protect  the  classified  information,  and  whether  additional  unsecured  copies  of 
classified  information  currently  exist. 

The  sensitive  nature  of  the  information  on  Secretary  Clinton’s  personal  email  system  and 
server — classified  up  to  Top  Secret/'/Sensitive  Compartmented  Information— means  that  its 
release  or  dissemination  to  unauthorized  individuals  could  cause  “exceptionally  grave  damage  to 
national  security”  if  proper  steps  are  not  taken  to  ensure  its  safeguarding."  I am  also  deeply 
concerned  by  recent  reports  that  classified  information  in  Secretary  Clinton’s  email  may  exist 
outside  of  the  federal  government’s  possession.  Accordingly,  I ask  that  you  provide  the 
following  information: 

1 . When  and  how  did  the  FBI  first  become  aware  of  the  potential  existence  of  classified 
information  contained  in  Secretary  Clinton’s  personal  email? 

2.  How  many  FBI  agents  and  employees  have  been  assigned  to  investigate  matters  relating 
to  the  presence  of  classified  information  in  Secretary  Clinton’s  personal  email?  Please 
also  identify  the  FBI  component  entities  involved  in  this  matter. 

3.  When  does  the  FBI  expect  to  complete  its  examination  of  Secretary  Clinton’s  personal 
email  server? 

4.  Is  the  FBI  evaluating  the  extent  to  which  deleted  material  on  Secretary  Clinton’s  personal 
email  server  is  recoverable? 


* Memorandum  for  Sen.  Richard  Burr  et  al.  from  I.  Charles  McCullough,  HI,  Update  to  IC  IG  support  to  State 
Department  IG  (Aug.  1 1. 2015).  available  at  http://www.s^assley. senate.gov/sites/default/files/judiciary/iipload/ 
Classif{ed%20docs%2C%2008-I]-15%2C%20IClG%20CN%20-%20Update%2Qon%20aassif}ecfA 
20Materials%20oti%20Personat%20thumb%20drive.%20Clinton%20server.pdf 
’ Schmidt,  supra  note  1. 

Jd.  ',  Chris  Strohm  & Del  Quentin  Wilber,  FBI  said  to  examine  whether  Hillary  Clinton  e-mail  was  backed  up, 
Bloomberg,  Aug.  13, 2015;  Phillip  Bump,  Could  Hillary  Clinton 's  deleted  emails  be  recovered?  Maybe.,  WASH. 
Post,  Aug.  12, 201s.  For  example,  the  National  Security  Agency  and  Central  Security  Service,  which  are  charged 
with  securing  information  systems  containing  classified  information,  require  sanitization  of  media  that  stored 
classified  information  through  degaussing  or  physical  destruction.  Erasure,  even  overwriting  all  data  on  a drive  with 
multiple  passes,  is  not  sufficient  National  Security  Agency  Central  Security  Service,  NS  A/CSS  Policy  Manual  9- 1 2 
(Dec.  1 5,  20 14);  see  also  Defense  Security  Service,  Dep’t  of  Defense,  Industrial  Security  Letter  2007-0 1 (Oct,  1 1 , 
2007)  (“Effective  immediately,  DSS  will  no  longer  approve  overwriting  procedures  for  the  sanitization  or 
downgrading  (e.g.  release  to  lower  level  classified  information  controls)  of  IS  storage  devices  (e.g.,  hard  drives) 
used  for  classified  processing.”). 

' ' See  Classification  of  official  information,  1 8 C.F.R.  § 3a.  1 1 . 
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5.  Is  the  FBI  evaluating  the  extent  to  which  Secretary  Clinton’s  personal  email  server  may 
have  been  compromised  by  an  unauthorized  entity? 

6.  Is  the  FBI  conducting  a digital  forensic  analysis  of  Secretary  Clinton’s  personal  email 
server? 

7.  What  steps  is  the  FBI  taking  to  ensure  that  all  copies  of  classified  material  contained  in 
Secretary  Clinton’s  emails  are  appropriately  secured  in  the  federal  government’s 
possession? 

8.  Has  the  FBI  seized  all  servers  or  other  devices  used  to  back-up  Secretary  Clinton’s 
personal  email  server? 

9.  Has  the  FBI  seized  all  copies  of  the  thumb  drive  containing  Secretary  Clinton’s  personal 
email? 

1 0.  Is  the  FBI  currently  aware  of  the  existence  of  any  digital  or  hardcopy  media  outside  of 
the  possession  of  &e  federal  government  that  could  include  classified  information 
contained  in  Secretary  Clinton’s  emails? 

1 1 . Is  the  FBI  examining  or  auditing  the  physical  security  of  the  thumb  drive  and  email 
server  implemented  by  Secretary  Clinton  and/or  her  agents  or  representatives  prior  to  the 
time  that  the  FBI  seized  the  materials? 

12.  Is  the  FBI  storing  the  thumb  drive  and  email  server  seized  from  Secretary  Clinton  in  a 
sensitive  compartmented  information  facility? 

13.  Do  all  FBI  personnel  with  access  to  the  thumb  drive  and  email  server  seized  from 
Secretary  Clinton  have  appropriate  security  clearances? 

I ask  that  you  provide  responses  to  the  questions  above  as  soon  as  possible  but  no  later 
than  5:00  p.m.  on  August  31,  2015.  In  addition,  as  the  material  may  be  relevant  to  ongoing 
congressional  reviews  of  this  matter,  I ask  that  you  take  all  appropriate  steps  to  preserve  the  data 
contained  on  the  thumb  drive  and  email  server  in. the  FBI’s  possession. 

The  Committee  on  Homeland  Security  and  Governmental  Affairs  is  authorized  by  Rule 
XXV  of  the  Standing  Rules  of  the  Senate  to  investigate  “the  efficiency,  economy,  and 
effectiveness  of  all  agencies  and  departments  of  the  Government.”'^  Additionally,  S.  Res.  73 
(114th  Congress)  authorizes  the  Committee  to  examine  “the  efficiency  and  economy  of 
operations  of  all  branches  and  functions  of  the  Government  with  particular  reference  to  (i)  the 


S.  Rule  XXV(k);  see  also  S.  Res.  445,  108th  Cong.  (2004). 


• • 
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effectiveness  of  present  national  security  methods,  staffing,  and  processes For  purposes 

of  this  request,  please  refer  to  the  definitions  and  instructions  in  the  enclosure. 

If  you  have  anV  auctions  about  this  request,  please  ask  your  staff  to  contac] 

|of  the  Committee  staff  at  (202)  224-475 1 , Thank  you  for  your 
attention  to  this  important  mattet 


cc: 


The  Honorable  Thomas  R.  Carper 
Ranking  Meniber 
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ALL  II>JrOR3.i^TIO]J  COIITAIIIEE 

HSRZIH  IS  mJCLASSr^IED 

DATE  11““Q5“2D:6  EY  JTSJISTSO  MSICG 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  08/24/2015 

On  August  21,  2015,  the  enclosed  Request  for  Records  and 

Preservations  Requests  were  delivered  electronically  to  the 

and  a confirmation  of  receipt  was  acknowledged  by 


Investigation  on  08/21/2015 


ai 


Washington.  D.C. 


bVE 
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This  document  contains  neither  recommendations  nor  conclusions  of  the  FBL  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C.  20535-0001 


Date : 
To: 


From; 


August  21,  2015 


Charles  H.  Kable  iv 
Section  Chief 

Counterintelligence  Division 


J 


Subject;  Preservation  of  Records;  Request  for  Records  | 

The  Federal  Bureau  of  Investigation  (FBI)  formally  requests  that, 
pursuant  to  Title  18,  United  States  Code,  Section  2703  (f),|  jtake 
any  steps  necessary  to  preserve  all  electronic  and  transactional 
records  associated  with  ©clintonemail . com  email  accounts  contained  on 


This  preservation  request  applijes  to  all 


stored 

electronic  records,  files,  and  other  evidence  relating  to 
communications  to  and  from  the  @c lintonemail.com  e|-mail  address. 


On  July  6,  2015,  the  FBI  received  a Section  811(c)  Referral  from 
the  Inspector  General  of  the  Intelligence  Community  regar^ding  a 
potential  compromise  of  classified  information.!  Pursuant  tjo  this 
referral,  the  FBI  respectfully  requests 


cause  a comprehensive  search  to  be  conducted  of  all  holdings,:  files 


documents,  and  materials  in  the 


possessolon,  including  back- 


up computer  drives,  for  electronic  mail  communications  to  or  from 
@clintonemail . com  accounts.  Due  to  the  nature  of  the i FBI's 
investigation,  we  request  this  search  be  conducted  without'  undue 
delay  and  within  30  days  of  receipt  of  this  letter.  Should  responsive 
records  be  obtained,  this  Bureau  requests  an  eleptronic  copy  ^ of  all 
non- privileged  materials  be  provided  forthwith  while  a corresponding 
classification  review  of  those  records  is  conducted.  The  FBI  requests 
the  results  of  the  classification  review  be  prov’ided  to  thisj  Bureau 

banners 


when  complete.  In  addition,  the  FBI  seeks  a copy 


ONCLASS I FIED  / /-P©TJO- 

This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  ilt  is 
the  property  of  the  FBI  and  is  loaned  to  your  agency;  it  andj 
to  be  distributed  outside  your  agency. 


of  computer 


its  contents  are  not 


b7E 


b7E 


b7E 


miCLASSIFIED//POW 


Icomputer  systems  on  which  relevant  electronic 


from 

communicat ions  are  found . 

I 

You  are  reques:ed  not  to  disclose  the  existence  of  this  inquiry, 
other  than  as  necessary  for  compliance,  insofar  as  doing  so  may 
jeopardize  the  confidential  nature  of  the  FBI's  investigation. 

If  you  have  any  cruestions  regarding  this  request,  please  direct 
all  inquiries  to  Special  Agent 


Sincerely, 


b7E 


b6 

b7C 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 


UNC  LAS  SIFIED / /TOHO 

i I 

This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI,  It  is 
the  property  of  the  FBij and  is  loaned  to  your  agency;  it  and  its  contents  are  not 
to  be  di^stributed  outside  your  agency. 

I 
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U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C.  20535-0001 


ALL  FBI  IHrOR3.JATIGl-t  COHTAIl-lED 

HEREIR  15  Ul'ICLASSIFIED 
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Date : 
To; 


From; 


August  21,  2015 


Counterintelligence  Division 


b7E 


Subject;  Preservation  of  Records,-  Request  for  Recprds 


The  Federal  Bureau  of  Investigation  (FBI)  formally  requests  that. 


pursuant  to  Title  18,  United  States  Code,  Section  2703(f),  you  take 
any  steps  necessary  to  preserve  all  electronic  and  transactional 
records  associated  with  (Sclintonemail .com  email  accounts  contained  on 

systems.  This  preservation  request  applies  to  all 

electronic  records,  files,  and  other  evidence  relating  to 


your 
stored 

communications  to  and  from  the  ©clintonemail . com  ei-mail  address. 


b7E 


On  July  6,  2015,  the  FBI  received  a Section  811(c)  Referral  from 
the  Inspector  General  of  the  Intelligence  Community  regarding  a 
potential  compromise  of  classified  information]  Pursuant  to  this 
referral,  the  FBI  respectfully  requests  the 


cause  a comprehensive  search  to  be  conducted  of  all  holdings, 


possession,  including 
mail  communications  to  or 
the  nature  of  the  FBI's 


conducted  without  undue 
i 


files,  documents,  and  materials  in  the 
back-up  computer  drives,  for  electronic 
from  ©clintonemail . com  accounts.  Due  to 
investigation,  we  request  this  search  be 
delay  and  within  30  days  of  receipt  of  this  letter.  Should  responsive 
records  be  obtained,  this  Bureau  requests  ah  ele-ctronic  copy  of  all 
non-privileged  materials  be  provided  forthwith  while  a corresponding 
classification  review  of  those  records  is  conducted.  The  FBI  requests 

DMCLASS I FIED/ / peee- 

This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI . It  is 
the  property  of  the  FBI  and  is  loaned  to  your  agency;  it  and[ 
to  be  distributed  outside  your  agency. 


its  contents  are  not 


b7E 


DKCLAS  S I FIED/ /-Peee 


the  results  of  the | classification  review  be  provided  to  this  Bureau 
when  complete . In  addition,  the  FBI  seeks  a copy  of  computer  banners 
from  any 


computer  systems  on  which  relevant  electronic 


communications  are  found. 


You  are  requested  not  to  disclose  the  existence  of  this  inquiry, 
other  than  as  necessary  for  compliance,  insofar  as  doing  so  may 
jeopardize  the  confidential  nature  of  the  FBI's  investigation. 

If  you  have  any  questions  regarding  this  request,  please  direct 
all  inquiries  to  Special  Agent 

I 1 b7C 

I 

j Sincerely, 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 


♦ ♦ 
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This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is 
the  property  of  the  FBI (and  is  loaned  to  your  agency;  it  and  its  contents  are  not 
to  be  distributed  outside  your  agency. 
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U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C.  20535-0001 
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Date;  August  19,  2015 


TO: 


From:  Charles  H.  Kable 

Section  Chief 

Counterintelligence  Division 


b7E 


Subject:  Preservation  of  Records,-  Request  for  Recprds 


The  Federal  Bureau  of  Investigation  (FBI)  formally  requests  that, 
pursuant  to  Title  18,  United  States  Code,  Section  2703(f),  you  take 
any  steps  necessary  to  preserve  all  electronic  and  transactional 
records  associated  with  ©clintoiieniail .com  email  accounts  contained  on 
your  systems.  This  preservation  request  applies  to  all 
stored  electronic  records,  files,  and  other  evidence  relating  to 
communications  to  and  from  the  Oclintonemail .com  e-mail  address. 


bVE 


On  July  6,  2015,  the  FBI  received  a Section  811(c)  Referral  from 
the  Inspector  General  of  the  Intelligence  Community  regarding  a 
potential  compromise  of  classified  information.!  Pursuant  to  this 
referral,  the  FBI  respectfully  requests  the  I I 
cause  a comprehensive  search  to  be  conducted  of  holdings,  files. 


documents,  and  materials  in  the 


possession,  including 


back-up  computer  drives,  for  electronic  mail  communications  to  or 
from  Oclintonemail.  com  accounts.  Due  to  the  nature  of  the  FBI's 
investigation,  we  request  this  search  be  conducted  without  undue 
delay  and  within  30  days  of  receipt  of  this  letter.  Should  responsive 
records  be  obtained,  this  Bureau  requests  an  electronic  copy  of  all 
non- privileged  materials  be  provided  Torthwithj  while  a parallel 
classification  review  of  the  records  is  conducted  concomitantly.  The 
FBI  requests  the  results  of  the  classification  review  be  provided  to 
this  Bureau  when  complete.  In  addition,  the  .FBI  seeks  a copy  of 

UMCLASSiFim //*=«»  ; 


bVE 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is 
the  property  of  the  FBI  and  is  loaned  to  your  agency;  it  and  its  contents  are  not 
to  be  distributed  outside  your  agency. 


DMCLASS I FIED/  /9W3fr 


computer  banners  from  any 


computer  systems  on  which  relevant  bVE 


electronic  communications  are  found. 


You  are  requested  not  to  disclose  the  existence  of  this  inquiry, 
other  than  as  necessary  for  compliance,  insofar  as  doing  so  may 
jeopardize  the  confidential  nature  of  the  FBI's  investigation. 

If  you  have  any  questions  reuarding  this  recruest,  please  direct 
all  inquiries  to  Special  Agent  I 


b6 

b7C 


Sincerely, 


chailea  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 


ONCLAS SXFI ED/ / 


! 

This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is 
the  property  of  the  FBI j and  is  loaned  to  your  agency;  it  and  its  contents  are  not 
to  be  distributed  outside  your  agency. 


J7€J1ST80 


//HOPORIT 


To: 

Re: 


CD-4 From: 

(U)  I 


CD-4 

Date:  07/24/2015 


|FBI  IHFO. 

CLASSIFIED  BY;  HSIC 
REASCM;  1.4  <C) 


DECLASSIFY  OH;  12-31-2040 
DATE;  11-03-2016 
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Date:  08/04/2015 


Precedence:  ROUT INE 

To:  CD-4,  Counterespionage  Section 

From : CD - 4 

Contact : lA  | 

Approved  By: 

Drafted  By: 

Case  ID  #:  (U) 

Title:  {S//-«F)j 

Synopsis:  {U//P0U0)  To  document  background  research  of  Platte 

River  Networks , 


Details:  (U//FOUO)  A 24  June  2015  lestter  from  Williams  & 

Connolly  LLP  to  the  U.S.  Department  of  State  {USDS)  Office  of 
Inspector  General  identified  that  the  server  equipment  which 
hosted  former  Secretary  of  State  Clinton' s ©clintonemail . com 
account  during  her  tenure  as  Secretary  of  State  is  in  the 
custody  of  Platte  River  Networks  (PRN) . The  server  is  allegedly 
maintained  at  an  unidentified  secure  data  center  and  is 
allegedly  no  longer  active.  Williams  & Connolly  believes  the 
server  no  longer  contains  data  from  former  Secretary  Clinton' s 
©clintonemail . com  account . 

(U//FOU0)  CD  conducted  open  source  and  FBI  database 
checks  of  PRN  and  associated  persons.  Results  are  as  follows: 

(U)  ADDRESSES 

(U/ /FOUO)  According  to  the  PRN  website 
(www.platteriver.com),  PRN  recently  moved  to  a new  12,000  ft. 
office  space  at  5700  Washington  Street,  Denver  Colorado  80216. 
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bl 
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T//N0F0HN 
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From: 


To: 

Re: 


CD- 4 
(U) 


S^PK^Z/HOFORM 


CD- 4 


bate:  Qlf2Af20\S 


b3 
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According  to  LexisNexis  searches,  the  following  additional 
addresses  are  also  associated  with  PRN: 


* 


be 

b7C 


• 11900  E Cornell  Ave 
Aurora,  CO  20014 

• 5550  Britton  Pkwy 
Hilliard,  OH  43026 


be 

b7C 


(u/ /-FOU©")  The  LexisNexis  search  identified  the  11900  E Cornell 
Ave,  Aurora,  CO  20014  as  a property  owned  by  Platte  River 
Networks  for  the  purposes  of  "EQUIPMENT  FURNITURE  ETC." 


(U)  Open  source  information  indicated  | 

lis  a private  residence. 


(u/ /P0HO)  Experian  records  indicated] 

is  listed  as  a residential  address  fori 
1 r of  PRN . 

(U)  PHONE,  FAX,  & EMAIL 


(U/ AfOUO)  The  search  of  LexisNexis  also  identified  PRN's  phone 
as  303-255-1941  and  taxpayer  identification  number  (TIN)  as | ] 

1 PRN ^ s phor^e  number  is  also  associated  in  Experian  with 
a former  employee  of  PRN, 


(U)  PRN's  email  was  identified  through  open  source  as 
crc©platteriver . com  and  the  fax  number  was  listed  as  303-474- 
3942. 
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To:  CD- 4 

Re:  (U) r 


From: 


SlBfailj/ /WOFORH- 

CD-4 

Date:  07/24/2015 


b3 
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(U)  PRN  BUSINESS  SCOPE 

(U)  Open  source  information  indicates  PRN  has  approximately  25 
employees.  According  to  the  PRN  website,  PRN  provides  the 
following  services: 

• (U)  Managed  IT  Services  - Intuition:  Intuition  appears  to 
be  a business  technology  associated  with  network 
infrastructure  (including  servers,  storage  area  networks, 
firewalls,  switches,  and  workstations)  which  is  monitored 
by  PRN's  Intuition  Operations  Center i Intuition  provides 
network  security  delivered  on  premise  and  through  the 
cloud,  including  endpoint  security  for  servers  and  devices, 
next  generation  firewalls,  unified  threat  protection, 
monitoring,  mobile  protection,  web  and  email  security. 
Intuition  also  provides  remote  management  of  mobile  devices 
including  remote  monitoring,  setup,  security  and  vendor 
management . 

• (U)  Technology;  According  to  the  PRN  website,  PRN  offers 
consultations  for  technology  projects,  technology 
procurements,  and  continuity  of  business  assessments  and 
solutions.  PRN  has  over  25  full-time  engineers  specializing 
in  integration,  virtualization,  security,  remote  access, 
wireless,  mobility,  cloud,  exchange,  server,  desktop, 
firewall,  switching,  system  administration,  storage, 
disaster  recovery,  business  continuity,  endpoint 
protection,  archiving,  data  recovery,  power,  migration. 
Office  365,  cabling,  VoIP,  encryption,  ISP,  voice/data 
bandwidth,  active  directory,  group  policy,  and  DNS. 

• (U)  Cloud:  PRN  provides  cloud  computing  with  expertise  in 
hybrid,  public,  and  private  cloud  infrastructure.  PRN 
offers  desktop  virtualization  to  provide  a flexible  and 
secure  desktop  delivery.  PRN' s cloud  services  provide 
storage,  backup,  and  disaster  recovery,  ensuring  their 
clients'  data  is  always  available  and  protected,  PRN 
maintains  cloud  security  solutions  provide  up-to-date 
protection  by  utilizing  the  ability  to  push  critical  real 
time  updates  to  all  devices  on  the  networks,  PRN  offers 
Microsoft's  Office  365  to  clients,  enabling  cloud-based 
Microsoft  Office  application  usiige, 

• (U)  Telecom:  PRN  claims  to  reprpsent  the  top  25  bandwidth 
providers  and  provides  on-site  cabling  assessments  to 
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jBe^T//NOFOmT- 

To : CD-4  From:  CD-4 

Re:  (U)  I ~|Date:  07/24/2015 


determine  if  clients  are  equipped  with  sufficient  CAT  5/6 
cabling  for  network,  voice  and  data  to  perform  at  top 
speeds.  PRN  also  offers  conference  call  and  web  meeting 
solutions,  including  hardware,  software,  and  managed 
services.  PRN's  website  advertises  business  mobility  by 
stating ; 

"Your  business  must  be  mobile,  including  your  company 
workforce.  You  need  to  access  your  company  data  from  all 
devices,  anywhere  and  anytime.  We  represent  the  top 
carriers  from  across  the  country  and  can  procure,  monitor 
and  manage  all  of  your  mobile  devices  including  laptops, 
tablets,  and  smartphones  - iPhones,  iPads,  Droids,  and 
Windows . " 

(U)  FBI  OBSERVED  COMPROMISES  OP  PEN  CLIENTS 

(U)  In  July  2015,  on  behalf  of  FBI  San  Die'gc,,  FBI  Denver  cited 
PRW  as  providing  contract  IT  services  for  a'  hon-profit  business 
in  Denver  that  was  the  potential  victim  of  a'  ciwt^v.ter  intrusion 
I I.  PRN  Director  of  Consulting 

Services  at  Platte  River  Networks  provided  log  and  system  files 
for  the  victim  company' s website  to  FBI  Denver  circa  10  July 
2015  . 

(B^’/NF)  FBI  Denver  cited  PRN  as  providing  contract  IT  services 
for  a law  firm  in  Denver  that  was  the  victim  of  a computer 
intrusion  in  March  2010.  The  Denver  law  firm  terminated  their 
contract  with  PRN  shortly  thereafter.  According  to  the  case 
file,  FBI  Denver  did  not  contact  PRN  regarding  the  computer 
intrusion. 

(U)  TIMELINE 

(U)  The  following  is  a timeline  of  key  PRN  events  provided  on 
the  PRN  website: 


• 

(U) 

2002  : 

PRN 

founded 

• 

(U) 

2004  : 

PRN 

founding  partners  hired  the  first  employee 

• 

(U) 

2005  : 

PRN 

began  offering  cloud  services 

(U) 

2008  : 

PRN 

launched  Intuition 

s|3ss|^/ /NOFORN 


/Hopoiat 


To:  CD -4  From:  CD -4 

Re:  (U)|  ~|D^te;  01I2AI2Q:ls 

• (U)  2009:  PRN  offered  full  Managed  Services 

• (U)  2010:  PRN  launched  Telecom  Division 

• (U)  2012:  PRN  launched  the  Intuition  Operations  Center  and 
associated  Help  Desk 

(U)  PRN  EXECUTIVE  MANAGEMENT 

(U)  PEN'S  website  identified  PRN  executive  management  and 
provided  additional  information  for  each  person. 

(U) 


From: 


b3 
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To:  CD- 4 

Re:  (U) [ 


/wePO*M“ 


CD-4 

] Date:  07/24/2015 


(U)  CORPORATE  PARTNERS 


b6 
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b6 

b7C 


(U)  According  to  their  website,  PRN  maintains  hardware 
partnerships  with  Dell,  Fortinet,  Allworx,  Datto,  CISCO,  ADTRAN, 
HP,  EQUALLOGIC,  EATON,  PowerADVANTAGE,  and  Synology. 

(U)  PEN'S  software  partners  include  Microsoft,  Office365, 
mimecast,  WEBROOT,  vmware,  Dell,  Autotask,  LabTech,  Datto, 

Sky Kick,  STORAGE CRAFT,  VEEAM,  and  Worldox, 

(U)  PEN'S  service  partners  are  Windstream  Communications, 
CenturyLink,  PanTerra,  Comcast,  Integra,  RingCentral,  TW 
Telecom,  AT&T,  MobileWare,  and  MHO. 

(U)  PEN'S  strategic  partners  include  INGRAM  Micro,  CUSN,  and 
Trust  Alliance. 


♦ ♦ 
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U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D C.  20535-0001 


ALL  IM?ORS.lATIOll  COHTAIl'IHC 

HSSZIH  IS  ^CLASSIFIED 

DATS  11-03-2:016  BY  J7ejl3TS0  HSICG 


August  18,  2015 


Re;  Request  for  Preservation  of  Records 

Dear  Custodian  of  Records; 

Pursuant  to  Title  1 8,  United  States  Code  Section  2703(f),  this  letter  is  a formal  request  for  the 
preservation  of  all  stored  communications,  records  and  other  evidence  in  your  possession  regarding 
the  following  e-mail  accounts,  pending  further  legal  process. 


1 

2 

3 

4 

t; 


b7E 


.b6 

b7i 

b7: 


You  are  hereby  requested  to  preserve  the  records  described  below  currently  in  your 
possession,  including  records  stored  on  backup  media,  in  a form  that  includes  the  complete  record, 
and  records  that  may  come  into  your  possession  from  the  date  of  acknowledgment  of  this  request  for 
a period  of  90  days , or  until  receipt  of  a legal  court  order,  whichever  occurs  first.  This  request 
applies  only  retrospectively.  It  does  not  in  any  way  obligate  you  to  capture  and  preserve  new 
information  that  arises  after  the  date  of  this  request. 

You  are  also  requested  not  to  disclose  the  existence  of  this  request  to  the  subscriber  or  any 
other  person,  other  than  as  necessary  to  comply  with  this  request,  as  the  FBI’s  investigation  may  be 
jeopardized  by  this  type  of  disclosure.  You  are  also  requested  not  to  close  the  account  of  the 
subscriber,  unless  requested  to  do  so  by  the  subscriber.  If  compliance  with  this  request  may  result 


in  a permanent  or  temporary  termination  of  service  to  the  accounts  described  below,  or  otherwise 
alert  the  subscriber  or  user  of  these  accounts  as  to  your  actions  to  preserve  the  referenced files 


and  records,  please  contact  Special  Agent 
and  before  taking  any  such  actions. 


as  soon  as  possible 


b6 

b7C 


This  preservation  request  applies  to  the  following  records  and  evidence: 


A.  The  contents  of  any  communication  or  for  the  accounts  any  associated  accounts, 
and  any  information  associated  with  those  communications  or  files,  such  as  the 
source  and  destination  email  address  or  IP  address. 

B.  All  records  and  other  evidence  relating  to  the  subscriber(s),  customer(s),  account 
holder(s),  or  other  entity(ies)  associated  with  the  requested  account  including,  without 
limitation,  subscriber  names,  user  names,  screen  names  or  other  identities,  mailing 
addresses,  residential  addresses,  business  addresses,  e-mail  addresses  and  other 
contact  information,  telephone  numbers  or  other  subscriber  number  or  identity,  billing 
records,  information  about  the  length  of  service  and  the  types  of  services  the 
subscriber  or  customer  utilized,  and  any  other  identifying  information,  whether  such 
records  or  other  evidence  are  in  electronic  or  other  form;  and 

C.  All  connection  logs  and  records  of  user  activity  for  the  requested  account,  including: 

1 . Connection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  Method  of  connection  (e.g.,  telnet,  ftp,  http); 

4.  Data  transfer  volume; 

5.  User  name  associated  with  the  connection  and  other  connection  information,  including 
the  Internet  Protocol  address  of  the  source  of  the  connection; 

6.  Telephone  caller  identification  records;  and 

7.  Connection  information  for  other  computers  to  which  the  user  of  the  above-referenced 
accounts  connected,  by  any  means,  during  the  connection  period,  including  the 
destination  IP  address,  connection  time  and  date,  disconnect  time  and  date,  method  of 
connection  to  the  destination  computer,  the  identities  (account  and  screen  names)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such  connection 
information  relates,  and  all  other  information  related  to  the  connection  from  ISP  or  its 
subsidiaries. 

■ 8.  Means  and  source  of  payment  for  such  Service:  (including  any  credit  card  or  bank  account 
number)  and  billing  records. 

D.  Any  other  records  and  other  evidence  relating  tt  .ihe  requested  account.  Such  records  and  other 
evidence  include,  without  limitation,  correspondence  and  other  records  of  contact  by  any  person 
or  entity  about  the  above-referenced  account,  the  content  and  connection  logs  associated  with  or 
relating  to  postings,  commimications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 


• # 


If  you  have  any  questions  regarding  this  request,  please  direct  all  inquiries  to  Special  Agent 
who  can  be  reached  atl  foi 
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Sincerely,  - 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 
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ALL  iirroFaiATiGii  CDirTAirizc 
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U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C.  20535-0001 


August  18,  2015 


Re:  Request  for  Preservation  of  Records 

Dear  Custodian  of  Records: 

Pursuant  to  Title  18,  United  States  Code  Section  2703(f),  this  letter  is  a formal  request  for  the 
preservation  of  all  stored  communications,  records  and  other  evidence  in  your  possession  regarding 
the  following  e-mail  accounts,  pending  further  legal  process. 


1 
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5 

6 

7 
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9 

10 

11 

12 
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14 

15 

16 

17 

18 

19 

20 
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177 
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181 
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206 

207 
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209 
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213 

214 

215 

216 

217 

218 

219 

220 
221 
222 

223 

224 
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229 
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231 
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238 

239 

240 

241 

242 

243 

244 
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309 
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319 
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You  are  hereby  requested  to  preserve  the  records  described  below  currently  in  your 
possession,  including  records  stored  on  backup  media,  in  a form  that  includes  the  complete  record, 
and  records  that  may  come  into  your  possession  from  the  date  of  acknowledgment  of  this  request  for 
a period  of  90  days , or  until  receipt  of  a legal  court  order,  whichever  occurs  first.  This  request 
applies  only  retrospectively.  It  does  not  in  any  way  obligate  you  to  capture  and  preserve  new 
information  that  arises  after,  the  date  of  this  request. 


You  are  also  requested  not  to  disclose  the  existence  of  this  request  to  the  subscriber  or  any 
other  person,  other  than  as  necessary  to  comply  with  this  request,  as  the  FBI's  investigation  may  be 
jeopardized  by  this  type  of  disclosure.  You  are  also  requested  not  to  close  the  account  of  the 
subscriber,  unless  requested  to  do  so  by  the  subscriber.  If  compliance  with  this  request  may  result 
in  a permanent  or  temporary  termination  of  service  to  the  accounts  described  below,  or  otherwise 


alert  the  subscriber  or  user  of  these  accounts  as  to  your  actions  to  preserve  the  referenced files 


and  records,  please  contact  Special  Agent 
and  before  taking  any  such  actions. 


as  soon  as  possible 
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This  preservation  request  applies  to  the  following  records  and  evidence: 


A.  The  contents  of  any  communication  or  for  the  accounts  any  associated  accounts, 
and  any  information  associated  with  those  communications  or  files,  such  as  the 
source  and  destination  email  address  or  IP  address. 

B.  All  records  and  other  evidence  relating  to  the  subscriber(s),  customer(s),  account 
holder(s),  or  other  entity(ies)  associated  with  the  requested  account  including,  without 
limitation,  subscriber  names,  user  names,  screen  names  or  other  identities,  mailing 
addresses,  residential  addresses,  business  addresses,  e-mail  addresses  and  other 
contact  information,  telephone  numbers  or  other  subscriber  number  or  identity,  billing 
records,  information  about  the  length  of  service  and  the  types  of  services  the 
subscriber  or  customer  utilized,  and  any  other  identifying  information,  whether  such 
records  or  other  evidence  are  in  electronic  or  other  form;  and 

C.  All  connection  logs  and  records  of  user  activity  for  the  requested  account,  including: 

1 . Cormection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  Method  of  cormection  (e.g.,  telnet,  ftp,  http); 

4.  Data  transfer  volume; 

5.  User  name  associated  with  the  cormection  and  other  cormection  information,  including 
the  Internet  Protocol  address  of  the  source  of  the  connection; 

6.  Telephone  caller  identification  records;  and 

7.  Cormection  information  for  other  computers  to  which  the  user  of  the  above-referenced 
accounts  connected,  by  any  means,  during  the  connection  period,  including  the 
destination  IP  address,  connection  time  and  date,  disconnect  time  and  date,  method  of 
connection  to  the  destination  computer,  the  identities  (account  and  screen  names)  and 
subscriber  information,  if  knovm,  for  any  person  or  entity  to  which  such  connection 
information  relates,  and  all  other  information  related  to  the  connection  from  ISP  or  its 
subsidiaries. 

8.  Means  and  source  of  payment  for  such  service  (including  any  credit  card  or  bank  account 
number)  and  billing  records. 

D.  Any  other  records  and  other  evidence  relating  to  the  requested  account.  Such  records  and  other 
evidence  include,  without  limitation,  correspondence  and  other  records  of  contact  by  any  person 
or  entity  about  the  above-referenced  account,  the  content  and  connection  logs  associated  with  or 
relating  to  postings,  communications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 


.T 

who  can  be  reached  at 

1 ^ 



Sincerely, 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 
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U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C  20535-0001 


August  18,  2015 


Re:  Request  for  Preservation  of  Records 

Dear  Custodian  of  Records: 

Pursuant  to  Title  18,  United  States  Code  Section  2703(f),  this  letter  is  a formal  request  for  the 
preservation  of  all  stored  communications,  records  and  other  evidence  in  your  possession  regarding 
the  following  e-mail  accounts,  pending  further  legal  process. 
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You  are  hereby  requested  to  preserve  the  records  described  below  currently  in  your 
possession,  including  records  stored  on  backup  media,  in  a form  that  includes  the  complete  record, 
and  records  that  may  come  into  your  possession  from  the  date  of  acknowledgment  of  this  request  for 
a period  of  90  days  , or  until  receipt  of  a legal  court  order,  whichever  occurs  first.  This  request 
applies  only  retrospectively.  It  does  not  in  any  way  obligate  you  to  capture  and  preserve  new 
information  that  arises  after  the  date  of  this  request. 


You  are  also  requested  not  to  disclose  the  existence  of  this  request  to  the  subscriber  or  any 
other  person,  other  than  as  necessary  to  comply  with  this  request,  as  the  FBI's  investigation  may  be 
jeopardized  by  this  type  of  disclosure.  You  are  also  requested  not  to  close  the  account  of  the 
subscriber,  unless  requested  to  do  so  by  the  subscriber.  If  compliance  with  this  request  may  result 
in  a permanent  or  temporary  termination  of  service  to  the  accounts  described  below,  or  otherwise 
alert  the  subscriber  or  user  of  these  accounts  as  to  vour  actions  to  preserve  the  referenced files 
and  records,  please  contact  Special  Agent  as  soon  as  possible 

and  before  taking  any  such  actions. 


This  preservation  request  applies  to  the  following  records  and  evidence; 
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A.  The  contents  of  any  communication  or  for  the  accounts  any  associated  accounts, 
and  any  information  associated  with  those  communications  or  files,  such  as  the 
source  and  destination  email  address  or  IP  address. 

B.  All  records  and  other  evidence  relating  to  the  subscriber(s),  customer(s),  account 
holder(s),  or  other  entity(ies)  associated  with  the  requested  account  including,  without 
limitation,  subscriber  names,  user  names,  screen  names  or  other  identities,  mailing 
addresses,  residential  addresses,  business  addresses,  e-mail  addresses  and  other 
contact  information,  telephone  numbers  or  other  subscriber  number  or  identity,  billing 
records,  information  about  the  length  of  service  and  the  types  of  services  the 
subscriber  or  customer  utilized,  and  any  other  identifying  information,  whether  such 
records  or  other  evidence  are  in  electronic  or  other  form;  and 

C.  All  connection  logs  and  records  of  user  activity  for  the  requested  account,  including: 

1 . Connection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  Method  of  connection  (e.g.,  telnet,  ftp,  http); 

4.  Data  transfer  volume; 

5.  User  name  associated  with  the  connection  and  other  connection  information,  including 
the  Internet  Protocol  address  of  the  source  of  the  connection; 

6.  Telephone  caller  identification  records;  and 


7.  Connection  information  for  other  computers  to  which  the  user  of  the  above-referenced 
accounts  connected,  by  any  means,  during  the  connection  period,  including  the 
destination  IP  address,  connection  time  and  date,  disconnect  time  and  date,  method  of 
connection  to  the  destination  computer,  the  identities  (account  and  screen  names)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such  connection 
information  relates,  and  all  other  information  related  to  the  connection  from  ISP  or  its 
subsidiaries. 

8.  Means  and  source  of  payment  for  such  service  (including  any  credit  card  or  bank  account 
number)  and  billing  records. 

D.  Any  other  records  and  other  evidence  relating  to  the  requested  account.  Such  records  and  other 
evidence  include,  without  limitation,  correspondence  and  other  records  of  contact  by  any  person 
or  entity  about  the  above-referenced  account,  the  content  and  connection  logs  associated  with  or 
relating  to  postings,  communications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 
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U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation . 

Washington,  D.C.  20535-0001 


August  18 , 2015 


Re:  Request  for  Preservation  of  Records 

Dear  Custodian  of  Records: 


Pursuant  to  Title  1 8,  United  States  Code  Section  2703(f),  this  letter  is  a formal  request  for  the 
preservation  of  all  stored  communications,  records  and  other  evidence  in  your  possession  regarding 
the  following  e-mail  accounts,  pending  further  legal  process. 
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You  are  hereby  requested  to  preserve  the  records  described  below  currently  in  your 
possession,  including  records  stored  on  backup  media,  in  a form  that  includes  the  complete  record, 


and  records  that  may  come  into  your  possession  from  the  date  of  acknowledgment  of  this  request  for 
a period  of  90  days  , or  until  receipt  of  a legal  court  order,  whichever  occurs  first.  This  request 
applies  only  retrospectively.  It  does  not  in  any  way  obligate  you  to  capture  and  preserve  new 
information  that  arises  after  the  date  of  this  request. 


You  are  also  requested  not  to  disclose  the  existence  of  this  request  to  the  subscriber  or  any 
other  person,  other  than  as  necessary  to  comply  with  this  request,  as  the  FBI's  investigation  may  be 
jeopardized  by  this  type  of  disclosure.  You  are  also  requested  not  to  close  the  account  of  the 
subscriber,  unless  requested  to  do  so  by  the  subscriber.  If  compliance  with  this  request  may  result 
in  a permanent  or  temporary  termination  of  service  to  the  accounts  described  below,  or  otherwise 
alert  the  subscriber  or  user  of  these  accounts  as  to  your  actions  to  preserve  the  referenced files 


and  records,  please  contact  Special  Agent\^ 
and  before  taking  any  such  actions. 


as  soon  as  possible 


This  preservation  request  applies  to  the  following  records  and  evidence: 


A.  The  contents  of  any  communication  or  for  the  accounts  any  associated  accounts, 
and  any  information  associated  with  those  communications  or  files,  such  as  the 
source  and  destination  email  address  or  IP  address. 

B.  All  records  and  other  evidence  relating  to  the  subscriber! s),  customer(s),  account 
holder! s),  or  other  entity!ies)  associated  with  the  requested  account  including,  without 
limitation,  subscriber  names,  user  names,  screen  names  or  other  identities,  mailing 
addresses,  residential  addresses,  business  addresses,  e-mail  addresses  and  other 
contact  information,  telephone  numbers  or  other  subscriber  number  or  identity,  billing 
records,  information  about  the  length  of  service  and  the  types  of  services  the 
subscriber  or  customer  utilized,  and  any  other  identifying  information,  whether  such 
records  or  other  evidence  are  in  electronic  or  other  form;  and 

C.  All  connection  logs  and  records  of  user  activity  for  the  requested  account,  including; 

1 . Connection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  Method  of  connection  !e.g.,  telnet,  ftp,  http); 

4.  Data  transfer  volume; 

5.  User  name  associated  with  the  connection  and  other  connection  information,  including 
the  Internet  Protocol  address  of  the  source  of  the  connection; 

6.  Telephone  caller  identification  records;  and 

7.  Connection  information  for  other  computers  to  which  the  user  of  the  above-referenced 
accounts  connected,  by  any  means,  during  the  connection  period,  including  the 
destination  IP  address,  connection  time  and  date,  disconnect  time  and  date,  method  of 
connection  to  the  destination  computer,  the  identities  !account  and  screen  names)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such  connection 
information  relates,  and  all  other  information  related  to  the  connection  from  ISP  or  its 
subsidiaries. 

8.  Means  and  source  of  payment  for  such  service  !including  any  credit  card  or  bank  account 
number)  and  billing  records. 

D.  Any  other  records  and  other  evidence  relating  to  the  requested  account.  Such  records  and  other 
evidence  include,  without  limitation,  correspondence  and  other  records  of  contact  by  any  person 
or  entity  about  the  above-referenced  account,  the  content  and  connection  logs  associated  with  or 


• • 

relating  to  postings,  communications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 


If  you  have  any  questions  regarding  this  request,  please  direct  all  inquiries  to  Special  Agent 
kvho  can  be  reached  atl  I or  I I 


Sincerely, 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 
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U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C.  20535-0001 


August  18,  2015 
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Re:  Request  for  Preservation  of  Records 

Dear  Custodian  of  Records: 

Pursuant  to  Title  18,  United  States  Code  Section  2703(f),  this  letter  is  a formal  request  for  the 
preservation  of  all  stored  communications,  records  and  other  evidence  in  your  possession  regarding 
the  following  e-mail  accounts,  pending  further  legal  process. 
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You  are  hereby  requested  to  preserve  the  records  described  below  currently  in  your 
possession,  including  records  stored  on  backup  media,  in  a form  that  includes  the  complete  record, 
and  records  that  may  come  into  your  possession  from  the  date  of  acknowledgment  of  this  request  for 
a period  of  90  days , or  until  receipt  of  a legal  court  order,  whichever  occurs  first.  This  request 
applies  only  retrospectively.  It  does  not  in  any  way  obligate  you  to  capture  and  preserve  new 
information  that  arises  after  the  date  of  this  request. 


You  are  also  requested  not  to  disclose  the  existence  of  this  request  to  the  subscriber  or  any 
other  person,  other  than  as  necessary  to  comply  with  this  request,  as  the  FBI's  investigation  may  be 
jeopardized  by  this  type  of  disclosure.  You  are  also  requested  not  to  close  the  account  of  the 
subscriber,  unless  requested  to  do  so  by  the  subscriber.  If  compliance  with  this  request  may  result 
in  a permanent  or  temporary  termination  of  service  to  the  accounts  described  below,  or  otherwise 
alert  the  subscriber  or  user  of  these  accounts  as  to  your  actions  to  preserve  the  referenced files 


and  records,  please  contact  Special  Ageni^ 
and  before  taking  any  such  actions. 


as  soon  as  possible 


b6 

b7C 

b7E 


b6 

b7C 


This  preservation  request  applies  to  the  following  records  and  evidence: 


A.  The  contents  of  any  communication  or  for  the  accoimts  any  associated  accounts, 
and  any  information  associated  with  those  communications  or  files,  such  as  the 
source  and  destination  email  address  or  IP  address. 

B.  All  records  and  other  evidence  relating  to  the  subscriber(s),  customer(s),  account 
holder(s),  or  other  entity(ies)  associated  with  the  requested  account  including,  without 
limitation,  subscriber  names,  user  names,  screen  names  or  other  identities,  mailing 
addresses,  residential  addresses,  business  addresses,  e-mail  addresses  and  other 
contact  information,  telephone  numbers  or  other  subscriber  number  or  identity,  billing 
records,  information  about  the  length  of  service  and  the  types  of  services  the 
subscriber  or  customer  utilized,  and  any  other  identifying  information,  whether  such 
records  or  other  evidence  are  in  electronic  or  other  form;  and 

C.  All  connection  logs  and  records  of  user  activity  for  the  requested  account,  including: 

1 , Connection  date  and  time; 

2.  Disconnect  date  and  time; 


• • 

3.  Method  of  connection  (e.g.,  telnet,  ftp,  http); 

4.  Data  transfer  volume; 

5.  User  name  associated  with  the  connection  and  other  connection  information,  including 
the  Internet  Protocol  address  of  the  source  of  the  connection; 

6.  Telephone  caller  identification  records;  and 

7.  Connection  information  for  other  computers  to  which  the  user  of  the  above-referenced 
accounts  connected,  by  any  means,  during  the  connection  period,  including  the 
destination  IP  address,  connection  time  and  date,  disconnect  time  and  date,  method  of 
connection  to  the  destination  computer,  the  identities  (account  and  screen  names)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such  connection 
information  relates,  and  all  other  information  related  to  the  connection  from  ISP  or  its 
subsidiaries. 

8.  Means  and  source  of  payment  for  such  service  (including  any  credit  card  or  bank  account 
number)  and  billing  records. 

D.  Any  other  records  and  other  evidence  relating  to  the  requested  account.  Such  records  and  other 
evidence  include,  without  limitation,  correspondence  and  other  records  of  contact  by  any  person 
or  entity  about  the  above-referenced  account,  the  content  and  connection  logs  associated  with  or 
relating  to  postings,  communications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 


If  you  have  any  questions  regarding  this  request,  please  direct  all  inquiries  to  Special  Agent 


kvho  can  be  reached  at 


Fi 
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Sincerely, 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 
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U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C.  20535-0001 


August  18,  2015 

John  Kerry 
Secretary  of  State 
U.S,  State  Department 
2201  C Street,  NW 
Washington,  DC  20520 

Re:  Request  for  Preservation  of  Records 

Dear  Secretary  Kerry: 

Pursuant  to  Title  18,  United  States  Code  Section  2703 (^,  this  letter  is  a formal  request  for  the 
preservation  of  all  stored  communications,  records  and  other  evidence  in  your  possession  regarding 
the  following  e-mail  accounts,  pending  further  legal  process. 


1 

2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 


b6 

b7C 

b7E 


23 

24 

25 

26 

27 

28 

29 

30 

31 

32 

33 

34 

35 

36 

37 

38 

39 

40 

41 

42 

43 

44 

45 

46 

47 

48 

49 

50 

51 

52 

53 

54 

55 

57 

58 

59 

60 
61 
62 

63 

64 

65 

66 

67 

68 
69 


be 

b7C 

b7E 


116 

117 

118 
119 
120 
121 
122 

123 

124 

125 

126 

127 

128 
129 

130 

131 

132 

133 

134 

135 

136 

137 

138 

139 

140 

141 

142 

143 

144 

145 

146 

147 

148 

149 

150 

151 

152 

153 

154 

155 

156 

157 

158 

159 

160 
161 


b6 

bVC 

b7E 


208 

209 

210 
211 
212 

213 

214 

215 

216 

217 

218 

219 

220 
221 
222 

223 

224 

225 

226 

227 

228 

229 

230 

231 

232 

233 

234 

235 

236 

237 

238 

239 

240 

241 

242 

243 

244 

245 

246 

247 

249 

250 

251 

252 

253 

254 


b6 

b7C 

b7E 


301 

302 

303 

304 

305 

306 

307 

308 

309 

310 

311 

312 

313 

314 

315 

316 

317 

318 

319 

320 

321 

322 

323 

324 

325 

326 

327 

328 

329 

330 

331 

332 

333 

334 

335 

336 

337 

338 

339 

340 

341 

342 

343 

344 

345 

346 


b6 

bVC 

b7E 


347 

348 

349 

350 

351 

352 

353 

354 

355 

356 

357 

358 

359 

360 

361 

362 

363 

364 

365 

366 

367 

368 

369 

370 

371 

372 

373 

374 

375 

376 

377 

378 

379 

380 

381 

382 

383 

384 

385 

386 

387 

388 

389 

390 

391 

392 


b6 

bVC 

b7E 


393 

394 

395 

396 

397 

398 

399 

400 

401 

402 

403 

404 

405 

406 

407 

408 

409 

410 

411 

412 

413 

414 

415 

416 

417 

418 

419 

420 

421 

422 

423 

424 

425 

426 

427 
428. 

429 

430 

431 

432 

433 

434 

435 

436 

437 

438 


b6 

bVC 

b7E 


b6 

b7C 

b7E 


439 

440 

441 

442 

443 

444 

445 

446 

447 

448 

449 

450 

451 

452 

453 

454 

455 

456 

457 

458 

459 

460 

461 

462 
463 
464' 

465 

466 

467 

468 

469 

470 

471 

472 

473 

474 

475 

476 

477 

478 

479 

480 

481 

482 

483 

484 


531 

532 

533 

534 

535 

536 

537 

538 

539 

540 

541 

542 

543 

544 

545 

546 

547 

548 

549 

550 

551 

552 

553 

554 

555 

556 

557 

558 

559 

560 

561 

562 

563 

564 

565 

566 

567 

568 

569 

570 

571 

572 

573 

574 

575 

576 


b6 

b7C 

b7E 


624 

625 

626 

627 

628 

629 

630 

631 

632 

633 

634 

635 

636 

637 

638 

639 

640 

641 

642 

643 

644 

645 

646 

647 

648 

649 

650 

651 

652 

653 

654 

655 

656 

657 

658 

659 

660 
661 
662 

663 

664 

665 

666 

667 

668 
669 


b6 

b7C 

b7E 


670 

671 

672 

673 

674 

675 

676 

677 

678 

679 

680 
681 
682 

683 

684 

685 

686 

687 

688 

689 

690 

691 

692 

693 

694 

695 

696 

697 

698 

699 

700 

701 

702 

703 

704 

705 

706 

707 

708 

709 

710 

711 

712 

713 

714 

715 


fa6 

b7C 

b7E 


762 

763 

764 

765 

766 

767 

768 

769 

770 

771 

772 

773 

774 

775 

776 

777 

778 

779 

780 

782 

783 

784 

785 

786 

787 

788 

789 

790 

791 

792 

793 

794 

795 

796 

797 

798 

799 

800 
801 
802 

803 

804 

805 

806 

807 

808 


b6 

b7C 

b7E 


855 

856 

857 

858 

859 

860 
861 
862 

863 

864 

865 

866 

867 

868 

869 

870 

871 

872 

873 

874 

875 

876 

877 

878 

879 

880 
881 
882 

883 

884 

885 

886 

887 

888 

889 

890 

891 

892 

893 

894 

895 

896 

897 

898 

899 

900 


b6 

b7C 

b7E 


I 


901 

902 

903 

904 

905 

906 

907 
90S 

909 

910 

911 

912 


You  are  hereby  requested  to  preserve  the  records  described  below  currently  in  your 
possession,  including  records  stored  on  backup  media,  in  a form  that  includes  the  complete  record, 
and  records  that  may  come  into  your  possession  from  the  date  of  acknowledgment  of  this  request  for 
a period  of  90  days  , or  until  receipt  of  a legal  court  order,  whichever  occurs  first.  This  request 
applies  only  retrospectively.  It  does  not  in  any  way  obligate  you  to  capture  and  preserve  new 
information  that  arises  after  the  date  of  this  request 


You  are  also  requested  not  to  disclose  the  existence  of  this  request  to  the  subscriber  or  any 
other  person,  other  than  as  necessary  to  comply  with  this  request,  as  the  FBI's  investigation  may  be 
jeopardized  by  this  type  of  disclosure.  You  are  also  requested  not  to  close  the  account  of  the 
subscriber,  unless  requested  to  do  so  by  the  subscriber.  If  compliance  with  this  request  may  result 
in  a permanent  or  temporary  termination  of  service  to  the  accounts  described  below,  or  otherwise 
alert  the  subscriber  or  user  of  these  accounts  as  to  vour  actions  to  preserve  the  referenced files 


and  records,  please  contact  Special  Agena 
and  before  taking  any  such  actions.  ^ 


as  soon  as  possible 


This  preservation  request  applies  to  the  following  records  and  evidence: 

A.  The  contents  of  any  communication  or  for  the  accounts  any  associated  accounts, 
and  any  information  associated  with  those  communications  or  files,  such  as  the 
source  and  destination  email  address  or  IP  address. 

B.  All  records  and  other  evidence  relating  to  the  subscriber(s),  customer(s),  account 
holder(s),  or  other  entity(ies)  associated  with  the  requested  account  including,  without 
limitation,  subscriber  names,  user  names,  screen  names  or  other  identities,  mailing 
addresses,  residential  addresses,  business  addresses,  e-mail  addresses  and  other 
contact  information,  telephone  numbers  or  other  subscriber  number  or  identity,  billing 
records,  information  about  the  length  of  service  and  the  types  of  services  the 
subseriber  or  customer  utilized,  and  any  other  identifying  information,  whether  such 
records  or  other  evidence  are  in  electronic  or  other  form;  and 

C.  All  connection  logs  and  records  of  user  activity  for  the  requested  account,  including: 

1 . Connection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  Method  of  connection  (e.g,,  telnet,  ftp,  http); 

4.  Data  transfer  volume; 
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5.  User  name  associated  with  the  connection  and  other  connection  information,  including 
the  Internet  Protocol  address  of  the  source  of  the  connection; 

6.  Telephone  caller  identification  records;  and 

7.  Connection  information  for  other  computers  to  which  the  user  of  the  above-referenced 
accounts  connected,  by  any  means,  during  the  connection  period,  including  the 
destination  IP  address,  connection  time  and  date,  disconnect  time  and  date,  method  of 
connection  to  the  destination  computer,  the  identities  (account  and  screen  names)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such  connection 
information  relates,  and  all  other  information  related  to  the  connection  from  ISP  or  its 
subsidiaries. 

8.  Means  and  source  of  payment  for  such  service  (including  any  credit  card  or  bank  account 
number)  and  billing  records, 

D.  Any  other  records  and  other  evidence  relating  to  the  requested  account.  Such  records  and  other 
evidence  include,  without  limitation,  correspondence  and  other  records  of  contact  by  any  person 
or  entity  about  the  above-referenced  account,  the  content  and  connection  logs  associated  with  or 
relating  to  postings,  communications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 


If  yon  have  any  questions  regarding  this  request,  n ease  direct  all  inquiries  to  Snecial  Agent 

or 


who  can  be  reached  at 


be 
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Sincerely, 


Charies  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 
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U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C  20535-0001 
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August  18,  2015 
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Re:  Request  for  Preservation  of  Records 


Dear 


Pursuant  to  Title  18,  United  States  Code  Section  2703(f),  this  letter  is  a formal  request  for  the 
preservation  of  all  stored  eommunications,  records  and  other  evidence  in  your  possession  regarding 
the  following  e-mail  accounts,  pending  further  legal  process. 
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You  are  hereby  requested  to  preserve  the  records  described  below  currently  in  your 
possession,  including  records  stored  on  backup  media,  in  a form  that  includes  the  complete  record, 
and  records  that  may  come  into  your  possession  from  the  date  of  acknowledgment  of  this  request  for 
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a period  of  90  days  , or  until  receipt  of  a legal  court  order,  whichever  occurs  first.  This  request 
applies  only  retrospectively.  It  does  not  in  any  way  obligate  you  to  capture  and  preserve  new 
information  that  arises  after  the  date  of  this  request. 


You  are  also  requested  not  to  disclose  the  existence  of  this  request  to  the  subscriber  or  any 
other  person,  other  than  as  necessary  to  comply  with  this  request,  as  the  FBI's  investigation  may  be 
jeopardized  by  this  type  of  disclosure.  You  are  also  requested  not  to  close  the  account  of  the 
subscriber,  unless  requested  to  do  so  by  the  subscriber.  If  compliance  with  this  request  may  result 
in  a permanent  or  temporary  termination  of  service  to  the  accounts  described  below,  or  otherwise 
alert  the  subscriber  or  user  of  these  accounts  as  to  your  actions  to  preserve  the  referenced files 


and  records,  please  contact  Special  Agen^ 
and  before  taking  any  such  actions. 


as  soon  as  possible 
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This  preservation  request  applies  to  the  following  records  and  evidence: 


A.  The  contents  of  any  communication  or  for  the  accounts  any  associated  accounts, 
and  any  information  associated  with  those  communications  or  files,  such  as  the 
source  and  destination  email  address  or  IP  address. 

B.  All  records  and  other  evidence  relating  to  the  subscriber(s),  customer(s),  account 
holder(s),  or  other  entity(ies)  associated  with  the  requested  account  including,  without 
limitation,  subscriber  names,  user  names,  screen  names  or  other  identities,  mailing 
addresses,  residential  addresses,  business  addresses,  e-mail  addresses  and  other 
contact  information,  telephone  numbers  or  other  subscriber  number  or  identity,  billing 
records,  information  about  the  length  of  service  and  the  types  of  services  the 
subscriber  or  customer  utilized,  and  any  other  identifying  information,  whether  such 
records  or  other  evidence  are  in  electronic  or  other  form;  and 

C.  All  connection  logs  and  records  of  user  activity  for  the  requested  accoimt,  including; 

1 . Connection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  . Method  of  connection  (e.g.,  telnet,  ftp,  http); 

, 4.  Data  transfer  volume; 

5.  User  name  associated  with  the  connection  and  other  connection  information,  including 
the  Internet  Protocol  yddress  of  the  source  of  the  connection; 

6.  Telephone  idciltification  records;  and 

7.  Connection  VtfonnsLicn  for  other  computers  to  which  the  user  of  the  above-referenced 
accounts  oqmie-ourd,  Ihy  any  means,  during  the  connection  period,  including  the 
destination  P acidress,  connection  time  and  date,  disconnect  time  and  date,  method  of 
connection  to  the  destination  computer,  the  identities  (accoimt  and  screen  names)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such  connection 
information  relates,  and  all  other  information  related  to  the  connection  from  ISP  or  its 
subsidiaries. 

8.  Means  and  source  of  payment  for  such  service  (including  any  credit  card  or  bank  account 
number)  and  billing  records. 

D.  Any  other  records  and  other  evidence  relating  to  the  requested  account.  Such  records  and  other 
evidence  include,  without  limitation,  correspondence  and  other  records  of  contact  by  any  person 


# • 

or  entity  about  the  above-referenced  account,  the  content  and  connection  logs  associated  with  or 
relating  to  postings,  communications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 


If  you  have  any  questions  regarding  this  request,  please  direct  all  inquiries  to  Special  Agent 
who  can  be  reached  aJ  I oil  I 


Sincerely, 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 
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U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C  20535-0001 


August  18,  2015 
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Re:  Request  for  Preservation  of  Records 

Dear  Custodian  of  Records: 

Pursuant  to  Title  1 8,  United  States  Code  Section  2703(f),  this  letter  is  a formal  request  for  the 
preservation  of  all  stored  communications,  records  and  other  evidence  in  your  possession  regarding 
the  following  e-mail  accounts,  pending  further  legal  process. 
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You  are  hereby  requested  to  preserve  the  records  described  below  currently  in  your 
possession,  including  records  stored  on  backup  media,  in  a form  that  includes  the  complete  record, 
and  records  that  may  come  into  your  possession  from  the  date  of  acknowledgment  of  this  request  for 
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a period  of  90  days  , or  until  receipt  of  a legal  court  order,  whichever  occurs  first.  This  request 
applies  only  retrospectively.  It  does  not  in  any  way  obligate  you  to  capture  and  preserve  new 
information  that  arises  after  the  date  of  this  request. 


You  are  also  requested  not  to  disclose  the  existence  of  this  request  to  the  subscriber  or  any 
other  person,  other  than  as  necessary  to  comply  with  this  request,  as  the  FBI's  investigation  may  be 
jeopardized  by  this  type  of  disclosure.  You  are  also  requested  not  to  close  the  account  of  the 
subscriber,  unless  requested  to  do  so  by  the  subscriber.  If  compliance  with  this  request  may  result 
in  a permanent  or  temporary  termination  of  service  to  the  accounts  described  below,  or  otherwise 
alert  the  subscriber  or  user  of  these  accounts  as  to  your  actions  to  preserve  the  referenced  files 


and  records,  please  contact  Special  Ageni^ 
and  before  taking  any  such  actions. 


p soon  as  possible 


This  preservation  request  applies  to  the  following  records  and  evidence; 
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A.  The  contents  of  any  communication  or  for  the  accounts  any  associated  accounts, 
and  any  information  associated  with  those  communications  or  files,  such  as  the 
source  and  destination  email  address  or  IP  address. 

B.  All  records  and  other  evidence  relating  to  the  subscriber(s),  customer(s),  account 
holder(s),  or  other  entity(ies)  associated  with  the  requested  account  including,  without 
limitation,  subscriber  names,  user  names,  screen  names  or  other  identities,  mailing 
addresses,  residential  addresses,  business  addresses,  e-mail  addresses  and  other 
contact  information,  telephone  numbers  or  other  subscriber  number  or  identity,  billing 
records,  information  about  the  length  of  service  and  the  types  of  services  the 
subscriber  or  customer  utilized,  and  any  other  identifying  information,  whether  such 
records  or  other  evidence  are  in  electronic  or  other  form;  and 

C.  All  connection  logs  and  records  of  user  activity  for  the  requested  account,  including; 

1 . Connection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  Method  of  connection  (e.g.,  telnet,  ftp,  http); 

4.  Data  transfer  volume; 

5.  User  name  associated  with  the  connection  and  other  connection  information,  including 
the  Internet  Protocol  address  of  the  source  of  the  connection; 

6.  Telephone  caller  identification  records;  and 

7.  Connection  information  for  other  computers  to  which  the  user  of  the  above-referenced 
accounts  connected,  by  any  means,  during  the  connection  period,  including  the 
destination  IP  address,  connection  time  and  date,  disconnect  time  and  date,  method  of 
connection  to  the  destination  computer,  the  identities  (account  and  screen  names)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such  connection 
information  relates,  and  all  other  information  related  to  the  connection  from  ISP  or  its 
subsidiaries. 

8.  Means  and  source  of  payment  for  such  service  (including  any  credit  card  or  bank  account 
number)  and  billing  records. 

D.  Any  other  records  and  other  evidence  relating  to  the  requested  account.  Such  records  and  other 
evidence  include,  without  limitation,  correspondence  and  other  records  of  contact  by  any  person 
or  entity  about  the  above-referenced  account,  the  content  and  connection  logs  associated  with  or 
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relating  to  postings,  communications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 


If  you  have  any  questions  regarding  this  request,  please  direct  all  inuniries  to  Special  Agent 
Iwho  can  be  reached  at  I lor 


Sincerely, 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 
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U.S.  Department  of  Justice 

Federal  Bureau  of  investigation 

Washington,  D.C.  20535-0001 


August  18,  2015 
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Re:  Request  for  Preservation  of  Records 

Dear  Custodian  of  Records: 

Pursuant  to  Title  1 8,  United  States  Code  Section  2703(f),  this  letter  is  a formal  request  for  the 
preservation  of  all  stored  communications,  records  and  other  evidence  in  your  possession  regarding 
the  following  e-mail  accounts,  pending  further  legal  process. 
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You  are  hereby  requested  to  preserve  the  records  described  below  currently  in  your 
possession,  including  records  stored  on  backup  media,  in  a form  that  includes  the  complete  record, 
and  records  that  may  come  into  your  possession  from  the  date  of  acknowledgment  of  this  request  for 
a period  of  90  days , or  until  receipt  of  a legal  court  order,  whichever  occurs  first.  This  request 
applies  only  retrospectively.  It  does  not  in  any  way  obligate  you  to  capture  and  preserve  new 
information  that  arises  ^er  the  date  of  this  request. 


You  are  alsc  'rhqufi^te*!  not  to  disclose  the  existence  of  this  request  to  the  subscriber  or  any 
other  person,  other  Aan^aa  |n^e^;ssary  to  comply  with  this  request,  as  the  FBI’s  investigation  may  be 
jeopardized  by  this  df  d^^osure.  You  are  also  requested  not  to  close  the  account  of  the 
subscriber,  unless  requested  to  do  so  by  the  subscriber.  If  compliance  with  this  request  may  result 
in  a permanent  or  temporary  termination  of  service  to  the  accounts  described  below,  or  otherwise 
alert  the  subscriber  or  user  of  these  accounts  as  to  your  actions  to  preserve  the  referenced files 


and  records,  please  contact  Special  Agenn 
and  before  taking  any  such  actions.  ^ 


, as  soon  as  possible 


This  preservation  request  applies  to  the  following  records  and  evidence: 
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A.  The  contents  of  any  communication  or  for  the  accounts  any  associated  accounts, 
and  any  information  associated  with  those  communications  or  files,  such  as  the 
source  and  destination  email  address  or  IP  address. 

B.  All  records  and  other  evidence  relating  to  the  subscriber(s),  customerfs),  account 
holdeifs),  or  other  entity(ies)  associated  with  the  requested  account  including,  without 
limitation,  subscriber  names,  user  names,  screen  names  or  other  identities,  mailing 
addresses,  residential  addresses,  business  addresses,  e-mail  addresses  and  other 
contact  information,  telephone  numbers  or  other  subscriber  number  or  identity,  billing 
records,  information  about  the  length  of  service  and  the  types  of  services  the 
subscriber  or  customer  utilized,  and  any  other  identifying  information,  whether  such 
records  or  other  evidence  are  in  electronic  or  other  form;  and 

C.  All  connection  logs  and  records  of  user  activity  for  the  requested  account,  including: 

1 . Connection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  Method  of  connection  (e.g.,  telnet,  ftp,  http); 


4.  Data  transfer  volume; 

5.  User  name  associated  with  the  connection  and  other  connection  information,  including 
the  Internet  Protocol  address  of  the  source  of  the  connection; 

6.  Telephone  caller  identification  records;  and 

7.  Connection  information  for  other  computers  to  which  the  user  of  the  above-referenced 
accounts  connected,  by  any  means,  during  the  coimection  period,  including  the 
destination  IP  address,  coimection  time  and  date,  disconnect  time  and  date,  method  of 
connection  to  the  destination  computer,  the  identities  (account  and  screen  names)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such  connection 
information  relates,  and  all  other  information  related  to  the  connection  fi'om  ISP  or  its 
subsidiaries. 

8.  Means  and  source  of  payment  for  such  service  (including  any  credit  card  or  bank  account 
number)  and  billing  records. 

D.  Any  other  records  and  other  evidence  relating  to  the  requested  account.  Such  records  and  other 
evidence  include,  without  limitation,  correspondence  and  other  records  of  contact  by  any  person 
or  entity  about  the  above-referenced  account,  the  content  and  connection  logs  associated  with  or 
relating  to  postings,  communications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 


If  von  have  any  questions  regarding  this  request,  please  direct  all  inquiries  to  Special  Agent 
[vho  can  be  reached  at  or 


Sincerely, 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 
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U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C.  20535-0001 


August  18,  2015 


Re:  Request  for  Preservation  of  Records 

Dear  Custodian  of  Records: 

Pursuant  to  Title  1 8,  United  States  Code  Section  2703(i),  this  letter  is  a formal  request  for  the 
preservation  of  all  stored  communications,  records  and  other  evidence  in  your  possession  regarding 
the  following  e-mail  accounts,  pending  further  legal  process. 
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You  are  hereby  requested  to  preserve  the  records  described  below  currently  in  your 
possession,  including  records  stored  on  backup  media,  in  a form  that  includes  the  complete  record, 
and  records  that  may  come  into  your  possession  from  the  date  of  acknowledgment  of  this  request  for 
a period  of  90  days  , or  until  receipt  of  a legal  court  order,  whichever  occurs  first.  This  request 
applies  only  retrospectively.  It  does  not  in  any  way  obligate  you  to  capture  and  preserve  new 
information  that  arises  after  the  date  of  this  request. 

You  are  also  requested  not  to  disclose  the  existence  of  this  request  to  the  subscriber  or  any 
other  person,  other  than  as  necessary  to  comply  with  this  request,  as  the  FBI's  investigation  may  be 
jeopardized  by  this  type  of  disclosure.  You  are  also  requested  not  to  close  the  account  of  the 
subscriber,  unless  requested  to  do  so  by  the  subscriber.  If  compliance  with  this  request  may  result 
in  a permanent  or  temporary  termination  of  service  to  the  accounts  described  below,  or  otherwise 
alert  the  subscriber  or  user  of  these  accounts  as  to  vour  actions  in  nreserve  thp  rtf  pnfHcifd  files 
and  records,  please  contact  Special  Agenn  as  soon  as  possible 

and  before  taking  any  such  actions. 

This  preservation  request  applies  to  the  following  records  and  evidence: 


A.  The  contents  of  any  communication  or  for  the  accounts  any  associated  accounts, 
and  any  information  associated  with  those  communications  or  files,  such  as  the 
source  and  destination  email  address  or  IP  address. 

B.  All  records  and  other  evidence  relating  to  the  subscriber(s),  customer(s),  account 
holder(s),  or  other  entity(ies)  associated  with  the  requested  account  including,  without 
limitation,  subscriber  names,  user  names,  screen  names  or  other  identities,  mailing 
addresses,  residential  addresses,  business  addresses,  e-mail  addresses  and  other 
contact  information,  telephone  numbers  or  other  subscriber  number  or  identity,  billing 
records,  information  about  the  length  of  service  and  the  types  of  services  the 
subscriber  or  customer  utilized,  and  any  other  identifying  information.  Whether  such 
records  or  other  evidence  are  in  electronic  or  other  form;  and 

C.  All  connection  logs  and  records  of  user  activity  for  the  requested  account,  including: 

1 . Connection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  Method  of  connection  (e.g.,  telnet,  ftp,  http); 

4.  Data  transfer  volume; 

5.  User  name  associated  with  the  connection  and  other  connection  information,  including 
the  Internet  Protocol  address  of  the  source  of  the  connection; 

6.  Telephone  caller  identification  records;  and 

7.  Connection  information  for  other  computers  to  which  the  user  of  the  above-referenced 
accounts  connected,  by  any  means,  during  the  connection  period,  including  the 
destination  IP  address,  connection  time  and  date,  disconnect  time  and  date,  method  of 
connection  to  the  destination  computer,  the  identities  (account  and  screen  names)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such  connection 
information  relates,  and  all  other  information  related  to  the  connection  from  ISP  or  its 
subsidiaries. 

8.  Means  and  source  of  payment  for  such  service  (including  any  credit  card  or  bank  account 
number)  and  billing  records. 

D.  Any  other  records  and  other  evidence  relating  to  the  requested  account.  Such  records  and  other 
evidence  include,  without  limitation,  correspondence  and  other  records  of  contact  by  any  person 
or  entity  about  the  above-referenced  account,  the  content  and  connection  logs  associated  with  or 
relating  to  postings,  communications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 


If  you  have  any  questions  regarding  this  request. 


who  can  be  reached  at|j 


or 


ease  direct  all  inquiries  to  Special  Agent 
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Sincerely, 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 
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U.S.  Department  of  Justice 

Federal  Bureau  of  Investigation 

Washington,  D.C.  20535-0001 


August  18,  2015 


b7E 


Re:  Request  for  Preservation  of  Records 

Dear  Custodian  of  Records: 

Pursuant  to  Title  18,  United  States  Coda  Section  370?(fT  this  letter  is  a formal  request  for  the 
preservation  of  all  stored  communications,  records  aitd  other  evluenee  in  your  possession  regarding 
the  following  e-mail  accounts,  pending  further  Icgftl  proees^;, 
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You  are  hereby  requested  to  preserve  the  records  described  below  currently  in  your 
possession,  including  records  stored  on  backup  media,  in  a form  that  includes  the  complete  record, 
and  records  that  may  come  into  your  possession  from  the  date  of  acknowledgment  of  this  request  for 
a period  of  90  days  , or  until  receipt  of  a legal  court  order,  whichever  occurs  first.  This  request 
applies  only  retrospectively.  It  does  not  in  any  way  obligate  you  to  capture  and  preserve  new 
information  that  arises  after  the  date  of  this  request. 


You  are  also  requested  not  to  disclose  the  existence  of  this  request  to  the  subscriber  or  any 
other  person,  other  than  as  necessary  to  comply  with  this  request,  as  the  FBI's  investigation  may  be 
jeopardized  by  this  type  of  disclosure.  You  are  also  requested  not  to  close  the  account  of  the 
subscriber,  unless  requested  to  do  so  by  the  subscriber.  If  compliance  with  this  request  may  result 
in  a permanent  or  temporary  termination  of  service  to  the  accounts  described  below,  or  otherwise 
alert  the  subscriber  or  user  of  these  accounts  as  to  vour  actions  to  preserve  the  referenced files 

as  soon  as  possible 


and  records,  please  contact  Special  Agenl^ 
and  before  taking  any  such  actions. 
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This  preservation  request  applies  to  the  following  records  and  evidence: 


A.  The  contents  of  any  communication  or  for  the  accounts  any  associated  accounts, 
and  any  information  associated  with  those  communications  or  files,  such  as  the 
source  and  destination  email  address  or  IP  address. 

B.  All  records  and  other  evidence  relating  to  the  subscriber(s),  customer(s),  account 
holder(s),  or  other  entity(ies)  associated  with  the  requested  account  including,  without 
limitation,  subscriber  names,  user  names,  screen  names  or  other  identities,  mailing 
addresses,  residential  addresses,  business  addresses,  e-mail  addresses  and  other 
contact  information,  telephone  numbers  or  other  subscriber  number  or  identity,  billing 
records,  information  about  the  length  of  service  and  the  types  of  services  the 
subscriber  or  customer  utilized,  and  any  other  identifying  information,  whether  such 
records  or  other  evidence  are  in  electronic  or  other  form;  and 

C.  All  connection  logs  and  records  of  user  activity  for  the  requested  account,  including: 

1 . Connection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  Method  of  connection  (e.g.,  telnet,  ftp,  http); 

4.  Data  transfer  volume; 

5.  User  name  associated  with  the  connection  and  other  connection  information,  including 
the  Internet  Protocol  address  of  the  source  of  the  connection; 

6.  Telephone  caller  identification  records;  and 

7.  Connection  information  for  other  computers  to  which  the  user  of  the  above-referenced 
accounts  connected,  by  any  means,  during  the  connection  period,  including  the 
destination  IP  address,  connection  time  and  date,  disconnect  time  and  date,  method  of 
connection  to  the  destination  computer,  the  identities  (account  and  screen  names)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such  connection 
information  relates,  and  all  other  information  related  to  the  connection  from  ISP  or  its 
subsidiaries. 

8.  Means  and  source  of  payment  for  such  service  (including  any  credit  card  or  bank  account 
number)  and  billing  records. 


D.  Any  other  records  and  other  evidence  relating  to  the  requested  account.  Such  records  and  other 
evidence  include,  without  limitation,  correspondence  and  other  records  of  contact  by  any  person 
or  entity  about  the  above-referenced  account,  the  content  and  connection  logs  associated  with  or 
relating  to  postings,  communications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  elqctfcia*c  or  other  form. 


If  you  have  any  questions  regarding  this  request.,  'laijeflsc  Bli.rect  all  inquiries  to  Special  Agent 
who  can  be  reached  at|  |oi|  


Sincerely, 


Charles  H.  Kable  IV 
Section  Chief 

Counterintelligence  Division 


(Rev.  05-01-2008) 
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FEDERAL  BUREAU  OF  INVESTIGATION 


FBI  iiiro. 

CLASSIFIED  EV:  H3ICG  J7€Ji3TS0 
REASaj;  1.4  (C) 

CECLA33IFY  OH:  12-31-2040 
DATE : ll-OS-2016 


Precedence.;.  RCUTiifE 
To:  Wasfiingtpon  Field 

From: 


Date:  08/25/2015 


Washington  Fife Id 
CD;-13 

Ofeijitact : SA 


Approved  By; 


Kable  Charles  H IV 


Drafted  By: 
■TT',  Case  ID  #: 

■i  ^ f 

Title: 


-•73 


(S) 


MISHANDLING  OF  CLASSIFIED ; 

UNKNOWN  SUBJECT  OR  COUNTRY ; 

SENSITIVE  INVESTIGATIVE  MATTER  (SIM) 


Synopsis:  (U/ /-FOUQj-  Deputy  Assistant  Director  (DAD) 

Counterintelligence  Division  (CD) , a Declassification  Authority  of 
FBI  information,  declassifies  the  following  information  for  release 
as  appropriate. 

Classdrfieii^By:  H83J83T44 
Derived  From7^FB5>HSTC^"dated  20130301 
Declas^ifyUn:  20401231 

Details:  (U//FOUO)  This  communication  declassifies  the  existence 

of  the  captioned  matter  with  the  signature  of  the  Deputy  Assistant 
Director  (DAD)  Counterintelligence  Division  (CD) , a 
Declassification  Authority  of  FBI  information.  Verbal  authorization 
to  declassify  this  information  was  previously  provided  by  Assistant 
Director  (AD)  Randall  Coleman,  Counterintelligence  Division  (CD) , 
an  Original  Classification  Authority  of  FBI  information,  on  August 
21,  2015. 

(U/ /FOU©)  The  DAD  authorizes  the  declassification  of  the  following 
inf ormat ion : 


b6 

b7C 


bl 

b3 

b7E 


//MOFORM 


(Rev.  05-01-2008) 


/NOrORW 

FEDERAL  BUREAU  OF  INVESTIGATION 


( U/ /"TOUe ) In  July  2 015,  the  FBI  initiated  the  captioned 
investigation  based  on  an  811  referral  from  the  Inspector  General 
for  the  Intelligence  Community  (ICIG)  regarding  the  possible 
compromise  of  classified  national  security  information. 

(u/ /fOUQj  The  potential  compromise  was  identified  when,  as  part  of 
a Freedom  of  Information  Act  (FOIA)  request,  the  U.S.  Department  of 
State  (DoS)  Office  of  Inspector  General  and  the  ICIG  were  reviewing 
electronic  mail  communications  from  a private  server  previously  used 
by  a State  Department  official  during  their  tenure  at  DoS.  An  initial 
review  of  this  material  identified  several  emails  containing 
classified  national  security  information  some  of  which  was  Top 
Secret . 

(U//^OUQ)  NSLB  concurs  that  the  declassification  of  the  existence 
of  this  investigation  is  necessary. 

(U)  In  an  attempt  to  acquire  authority  to  reveal  certain  information 
as  part  of  future  criminal  proceedings,  FBI  WFO  certifies  the 
following : 

1.  (U)  No  previously  unknown  sources  or  informants  were  revealed 
in  the  identified  material; 

2.  (U)  No  sensitive  sources  or  methods  were  disclosed; 

3.  (U)  No  information  will  be  disclosed  which  will  negatively 
impact  other  case  equities;  and 

4.  (U)  No  classified  information  from  any  other  agency  or 
foreign  government  will  be  disclosed. 


♦ ♦ 
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REASON:  1 . >J  'C; 

DECLASSIF'i'  CM:  12-31-2D40 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Precedence:  ROUTINE 


Date:  08/27/2015 


To:  Washington  Field 


From;  Washington  Field 
CI-13 

Contact : SA 


Approved  By; 
Drafted  By: 
Case  ZD  #:  (U) 

Title:  (S//NF) 


-'2x? 


Synopsis: Attaches  records  provided  by  Department  of 
State. 


Details:  {U/ /FOUO)  On  August  13,  2015,  in  response  to  an  FBI 
records  request  dated  August  11,  2015,  the  U.S.  Department  of 
State  (DoS) , provided  employee  profiles  for  14  of  the  15 
requested  individuals. 


(U/ /FOUO)  Additionally,  DoS  was  able  to  locate  signed  copies  of 
Classified  Information  Nondisclosure  Agreements  (Standard  Form 
312)  for  9 of  the  15  individuals. 


{ U / / FOU6-)  These  documents  are  attached  to  the  file  in  a physical 
lA.  ■ 
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Event  Title:  (S) 


Approved  By: 


Date:  09/03/2015 


Drafted  By: 


Case  ID 


»: 


(S//W^| I 

MISHANDLING  OF  CLASSIFIED; 

UNKNOWN  SUBJECT  OR  COUNTRY; 

SENSITIVE  INVESTIGATIVE  MATTER  (SIM) 


Pull  Investigation  Initiated;  07/10/2015 


Collected  From: 


Receipt  Given?: 
Holding  Office: 


tX)  Partner  Katherine  M.  Turner 
Williams  & Connolly  LLP 
725  12th  St  NW 

Washington,  District  Of  Columbia  20005 
No 

WASHINGTON  FIELD 


Details : No  Details  Provided 


Item  Type 
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Collected  By:  
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This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  a^;ency;  it  and  its 
contents  are  not  to  be  distributed  outside  your  agency. 
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b6 

b7C 


bl 

b3 

b7E 


Full  Investigation  Initiated:  07/10/2015 
■U]  Collected  From:  CHS 

Receipt  Given? : No 
Holding  Office:  WASHINGTON  FIELD 


Details : 


No  Details  Provided 


I tern  Type 

IB  Digital 


Description 

tU/  USB  Thumbdrive 

Collected  On:  09/03/2015 

Seizing  Individual : | ' 

Collected  By: 

Location  Area : NA 
Specific  Location:  NA 

Device  Type : USB  Micro  Storage  Device  (thumb  drive ) 
Number  of  Devices  Collected:  1 


b6 

b7C 


This  document  Contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it  and  its 
contents  are  not  to  be  distributed  outside  your  agency. 
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CLASSiriEC  RV:  MSICG  J75JieT80 
BEjkSail  1.4  (C) 

EECLASSIFY  ON:  12-31-2040 
CATE:  11-OS-201€ 


ALL  IMFOBliATia-I  COl^AII'IED 
HEREIN  IS  Ul'TC  LAS  SHIED  EXCEPT 
WTiERE  SHOlVia  DTHERv/ISE 


FD-1D87  (Rev.  5-8-10) 


/woFonw 


Official  Wbcorp 


hjvi  dif|M|ra)gnaif. 
bOnaftfE-  rvM*  teen-  ^ • 

FBI ' siibnnalNin  riMz/ix 


FEDERAL  BUREAU  OF  INVESTIGATION 

Colleoted  Hem  Ijo^ 


Event  Title: 
improved  By: 
Drafted  By: 
Case  ID  # 


(S) 


Date:  09/03/2015 


bl 

b3 

b7E 


b€ 

b7C 


^65 


(S/>MPt 

MISHANDLING  OF  CLASSIFIED; 

UNKNOWN  SUBJECT  OR  COUNTRY; 

SENSITIVE  INVESTIGATIVE  MATTER  (SIM) 


bl 

b3 

b7E 


B*ull  Investigation  Initiated:  07/10/2015 

:|U|  Collected  From:  Partner  Katherine  M.  Turner 

Williams  & Connolly  LLp 
725  12th  St  NW 

Washington,  District  Of  Columbia  20005 


Receipt  Given? : 

No 

Holding  Office; 

: WASHINGTON  FIELD 

Details:  ATo 

Details  Provided 

Item  Type  .jti 

IB  Digital  ’ '' 

Description 

Mix  Apple  Model  A1466  EMC  2925 
Collected  On:  08/25/2015 

S/N; 

C02P6aWBG940 

Seizina  Individual : 

b6 

Collected  By: 

b7C 

Location  Area:  NA 
Specific  Location:  NA 
Device  Type:  Computer 
Number  of  Devices  Collected: 


T//lf©F^W 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it  and  its 
contents  are  not  to  be  distributed  outside  your  agency. 


/MOFonK 


Title:  [S) 

Re:  I 


09/03/2015 


bl 

b3 

b7E 


IB  Digital  1 X Apple  : 

Model  A1466  EMC  2925 

S/N: 

C02P67K3G940 

Collected  On: 

08/25/2015 

Seizing  Individual:  | 

b6 

Collected  By:  | 

b7C 

Location  Area: 

NA 

Specific  Location:  NA 

Device  Type : 

Computer 

Number  of  Devices  Collected:  1 

IB  Digital  iU|  1 ^ Lexar 

16  GB  USB  Thumbdrive 

- N12610 

Collected  On: 

08/25/2015 

Seizing  Individual:  | 

Zl 

Collected  By: 

1 

J 

b7C 

Location  Area: 

NA 

Specific  Location:  NA 

Device  Type: 

USB  Micro  Storage  Device  (thumb  drive) 

Number  of  Devices  Collected:  1 

IB  Digital  1 X USB  Thumbdrive  Labeled  "HC 

Prime 

2" 

Collected  On: 

08/25/2015 

Seizina  Individual:  1 

1 b€ 

Collected  By: 

b7C 

Location  Area: 

FIa 

Specific  Location:  NA 

Device  Type: 

USB  Micro  Storage  Device  (thumb  drive) 

Number  of  Devices  Collected:  1 

IB  Digital  'Ul  1 X Apple  Model  A1466  EMC  2925 

S/N: 

C1MP69VUG940 

1 X MagSafe  2 

Power  Adapter 

Collected  On; 

08/25/2015 

Seizing  Individual:  1 

1 b6 

Collected  By: 

1 

] 

b7C 

Location  Area: 

NA 

Specific  Location:  NA 
Device  Type:  Computer 
Serial  Number:  C1MP69VUG940 
Number  of  Devices  Collected:  1 


T I /WAOASUd’ 
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SJBCTgT/  /MOPORH 


Title:  (5) 

Re:  I 


09/03/2015 


bl 

b3 

b7E 


IB  Digital  in!  (X  1 ^ Lenovo  Yoga  211  Model  20428  S/N:[ 
1 X Power/AC  Adapter  Model  AD2X65NLC2A 

Collected  On:  08/25/2015 

Seizing  Individual : 

Collected  By:  | 

Location  Area:  NA 
Specific  Location:  NA 

Device  Type:  Computer 

Serial  Number;  I I 

Number  of  Devices  Collected : 1 


.IB  Digital  []}] 


1 X Lenovo  Type  I 
AC  Adapter  P/N:  92P1109 
Collected  On:  08/25/2015 
Seizing  Individual:  I 
Collected  By: 

Location  Area:  NA 
Specific  Location:  NA 
Device  Type : Computer 
Number  of  Devices  Collected: 


IB  Digital  1 X Lenovo  Type  4236  - VQ5  S/N:  

1 X AC  Adapter  Model  42T4418 

1 X Dell  Mouse  DPPID:  CN  - 09RRC7  - 48729  - 385  - OPRS 


Collected  On:  08/25/2015 

Seizing  I ndividual : 

Collected  By:  

Location  Area:  NA 
Specific  Location:  NA 
Device  Type : Computer 
Serial  Number: 


Number  of  Devices  Collected: 


hS 
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hS 

hlC 


he 
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ALL  I^JyCFi>iATI□l^T  COl'ITAIlTED 
3EREIM  IS  mTCLASSIFIEE  EXCEPT 
'^^fHEKE  SFJQ^VIT  OTHERVilSE 


FD-m57{Rev,  5-S-IO) 


CLASSIFIED  BY:  MSICC  J7SJ1STS0 
REASOt-T:  1,4  (Z) 

□ECLASSIF"/  OI'T:  12 -SI -20 4 0 
DATE : 11-03-2016 

S^&Wg^/MOFORW- 


FEDERAL  BUREAU  OF  INVESTIGATION 

Eleotronlo  Communloatlort 


Title:  {U//P6^#©)  Submit  lA  Date:  09/04/2015 

Prom:  WASHIKGTOW  FIELD 

WP-CI13  

Contact ; 


Approved  By : SSA 


hS 

bVC 


Drafted  By; 


Case  ID 


(s/z-sF-) 

MISHANDLING  OF  CLASSIF! 

UNKNOWN  SUBJECT  OR  COUNTRY; 

SENSITIVE  INVESTIGATIVE  MATTER  (SIM) 


Synopsis:  (U//P0UQ)  To  submit  to  the  file  a lA  associated  with  the 

referenced  serial , 


Full  Investigation  Initiated;  07/10/2015 


Reference : 


Serial 


82 


bl 

b3 

b7E 


b3 

b7E 


Enclosure (s) : Enclosed  are  the  following  items; 

1*  (u//^we)\ 


Details : 

(U/ZTOt?©-)  This  communication  submits  to  the  file  a lA  associated 
with  Serial  $2  of  the  captioned  f ile , 


b7E 


S] 


//HOFOIW 


SBCTgT/  /MOFORM 


Title: 
Re: 


(U//f©ee) 


Submit  lA 

09/04/2015 


SgafiM/ /MOFORM 


b6 

b7C 


DECLASSIFIED  BY.  HSICG  J7«JiSTSD 


Interviewee:  (U)  Justin  Gregory  Cooper 
(U//F©TO)  DOB: 


(U//F©e©)S^]lI 
(U//fWO]| 


Suimmairy:  Justin  Cooper  registered  the  first  secure  socket  layer  (SSL) 
certificate  for  the  mail.cUntonemail.com  domain  with  Network 
Solutions  on  03/30/2009?  Additionally,  Cooper  is  currently  an  advisor 
to  former  President  Bill  Clinton  and  a Senior  Advisor  to  the 
technology  company,  Decision  Sciences  Corporation. 


be 

b7C 

bVE 


Details:  The  mail.cUntonemail.com  domain  was  registered  on  01/13/2009  by  Perfect  Privacy, 
LLC.^  Justin  Cooper  registered  with  Network  Solutions  the  first  secure  socket  layer  (SSL) 
certificate  for  the  mail.clintonemaiLcom  domain  on  03/30/2009,  allowing  encryption  for  web- 
based  applications.  A second  SSL  certificate  was  registered  on  02/05/2012  with  Network 
Solutions,  but  no  individual  was  listed  on  the  registration.  The  third,  and  current,  SSL  certificate 
was  registered  on  09/13/2013  with  GoDaddy  without  an  individual  listed  on  the  registration.^ 


(U)  Justin  Cooper  serves  as  an  advisor  to  former  President  Bill  Clinton.  Cooper’s  responsibilities 
include  managing  President  Clinton’s  personal  and  professional  relationships,  and  assisting  with 
political,  business  and  personal  finance  issues.  Cooper  served  many  roles  while  President  Clinton 
was  in  office,  including  Senior  Advisor  and  The  President’s  Aide.  He  has  participated  in 
extensive  international  travel  with  President  Clinton  and  helped  the  President  author  three  books. 
Cooper  was  involved  in  the  establishment  of  the  Clinton  Foundation  and  continues  to  support  it 
along  with  the  Global  Clinton  Initiative  and  the  Clinton  Family  Foundation^.  Coyper  holds  an 
email  address  tied  to  President  Clinton’s  domair 


(U)  Cooper  is  listed  as  the  point  of  contact  for  Calle  Mayor,  LLC.  The  corporation’s  address  is 


the  same  as  the  C 
property  at  whichl 


inton  residence  in  Chappaqua,  New  York.  Calle  Mayor,  LLC  owns  the 


(U)  Cooper  has  participated  in  advisory  engagements  outside  of  his  role  with  President  Clinton. 
Cooper  is  the  founder  and  CEO  of  Foxcroft  Strategy  Group,  LLC.  In  this  capacity.  Cooper 


1 . I 

^ Analysis  conducted  by  Venafi  TrustNet,  “Digital  Certificate  Forensics:  What  Venafi  TrustNet  Tells  Us  about  the  Clinton  Email 
Server  (03/11/2015) 

^ Cooper  Biography  on  Decision  Sciences  Corporation  website 
''  Whois.com 

^ Department  ofState  Consolidated  Consular  Database  information 

^ New  York  Times,  “Roger  Clinton  is  Wary,  Chatty  and  Still  Occasionally  Attracting  Attention''  (07/06/2015) 


b6 

b7C 


b6 

b7C 


b7E 


;gEeRET//t^roR?j 

- 


b3 

b7E 


D 


O 


S^BK^T/ZHOrORN 


provides  diverse  consulting  services  to  agencies  in  the  government,  non-profit  and  private 
sectors.^  Foxcroft  Strategy  Group,  LLC  was  incorporated  in  Delaware  on  1 1/12/20137  Cooper  is 
also  currently  a Senior  Advisor  for  Decision  Sciences  Corporation,  a technology  company  that 
utilizes  cargo  scanning  technology  to  detect  weapons  of  mass  destruction  (WMD)  proliferation, 
as  well  as  explosives  and  contraband  smuggling.  Decision  Sciences  Corporation  utilizes  an 
advisory  board  of  diverse  backgrounds,  including  scientists,  business  leaders  and  government 
officials  to  improve  their  business  capabilities.*  Finally,  Cooper  previously  served  as  a Senior 
Advisor  to  Teneo  Holdings.  Teneo  Holdings  is  a consulting  firm  co-founded  by  Doug  Band,  a 
prior  aide  to  President  Clinton,  Cooper  is  not  currently  listed  on  the  website  of  Teneo  Holdings.^ 


(U//SBt!)'  Cooper  served  as  the  B1/B2  non-immigrant  visa  (NIV)  sponsor  for[ 
(DOBJ  ‘ I on  NIV  applications  dated  10/23/2012  and  07/08/201 5 L 


be 

b7C 


(U)  Cooper  received  his  Juris  Doctorate  from  Fordham  University  and  a Bachelor  of  Arts  from 
American  University.^ 


Hi 


:u! 


Presmce  im  emails  provided  to  the  FBI  om  (D)8/®(6/2W5 

j(S5'/NF)  Cooper  is  associated  with  approximately  60  emails  that  were  provided  to  the  FBI  on 
08/06/2015.  Cooper’s  email  activity  indicates  he  anJ  I were  the  principal  conduit  to 

provide  information  to  President  Clinton,  as  President  Clinton  did  not  appear  to  utilize  a direct 
email  address.  The  Clinton  Foundation’s  Haiti  relief  effort  in  2010  was  the  most  fi-equent  topic  of 
conversation  by  Cooper,  encompassing  approximately  ten  emails. 


(U)  Author;  SOs[ 
(U)  Approval;  ASC 

ssa| 

] . 

- 

b6 

b7C 


b6 

b7C 


' Stale  of  Delarvare  Division  of  Corporations,  File  number  5431 135 
^ )>ifei»(imt  5;dences  Corporation  website 
Judicial  Watch*  “Teneo  & The  Clinton  Machine”  (04/30/2015) 
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^LL  FBI  Il^FORFIATICa^  COI'JTAIlffiD 

BEREIH  IS  LTT'JCLASSIFIEC 

CA.TE  11-D3-201€  BY  J7-6,J1STS0  USICG 


FD-302a(Rev.  10-6-95) 


-1- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  09/01/2015 


September  1,  2015,  Special  Agent| 
ssistant  United  States  Attorney,  Eastern  District  of  Virginia  (EDVA)  and| 


telephonically  spoke  with! 


Court  Security  Officer,  United  States  Department  of  Justice  (DOJ),  to  coordinate  the  transfer  of  digital 
media  from  the  Federal  Bureau  of  Investigation  (FBI)  to  DOJ. 


ollowing  the  discussion.  SA[ 


and  SA 


[^rhysically  provided  a 


pecurity  Specialist,  DOJ.  The  DVD  was  provided  by  the  Operational 


DVDto[ 

Technology  Division  (OTD)  and  contained  a copy  of  digital  content  previously  given  to  the  FBI  by 
Williams  and  Connolly  on  August  6*^  2015. 


be 

b7C 


be 

b7C 


Investigation  on  09/01/2015 at Washington,  DC 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency,  it 
and  its  contents  arc  not  to  be  distributed  outside  your  agency. 
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qf) 


FD-302a(Rev.  10-6-95) 


ALL  IMrGR3.y^Ti™  COllTAIMEE 

HZRZIH  IS  Ul^CLASSIFIED 

DATZ  11-05-2D16  BY  J76J1STS0  tlSICC 


-1- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Investigation  on  08/25/2015 at Washington,  DC 


Dale  dictated  N/A 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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FD-302a(Rev,  10-6-95) 


ALL  ILJyORi^IATIOH  COHTAIl'IEL 

HZRZIM  IS  UigCLASSIFIED 

DATE  11-09-2D16  BY  J7SJ18TS0  HSICG 


-1- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  09/03/2015 


b3 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBT  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


hS 

hlC 


UNCLASSIFIED/ /POUO 


ALL  IMFORiLATi™  COITTAIl'JZE 
IHZKZIN  IS  Ul^CLASSIFIEB 
DATE  11-09-2016  BY  J76J1STS0  NSICC 


FD-302a(Rev,  10-6^95) 


-1- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Dale  of  transcription  09/09/2015 


(U//FOUO 
response  from 


On  September  3 , 2015 , SA 


received  a 


brecrardincf  a preservation  request  for  the  account 
The  response  is  attached  to  this 


he 

hic 

b7E 


communication  in  an  FD-340. 


Investigation  on  09/03/201 5 at WashinjP:ton,  DC 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 
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UNCLASSI  FI  ED  / 


ALL  INFOPi^TIQia  COllTAIl^ED 
HEREIN  IS  mTCLASSIFIEE  EXCEPT 
VfflEKE  OTHERWISE 


FD-1057  (Rev  5-8-10) 


CLASSIFIED  BY:  NSICG  j76j1ST80 
RZASOM:  lA  (C) 

DECLASSIFY  QtL : 12-31-2040 
DATE.  11-09-2016 


T//HoronM 


■ ^ Official' RrooHP 

■jMl  iS  Odvtmh)  iiB^tapa^  Piaiw 


FEDERAL  BUREAU  OF  INVESTIGATION 


Eleofponlo  Communlocillon 


Title:  (U)  The  Submission  of  FD-340  Date:  09/16/2015 


CC: 


From:  WASHINGTON  FIELD 
WF-CI13 

Contact: I 


Approved  By:  SSA 


Drafted  By: 


Case  ID  #: 


MISHANDLING  OF  CLASSIFIED; 

UNKNOWN  SUBJECT  OR  COONTRY; 

SENSITIVE  INVESTIGATIVE  MATTER  (SIM) 


m 


Synopsis:  (UZ/PQUO)  To  document  the  submission  of  FD-340  (lA)  to  the 

lA  sub-file  of  the  captioned  case  file* 


Full  Investigation  Initiated:  07/10/2015 


Reference : 


Serial 


9 


Enclosure (s) : Enclosed  are  the  following  items: 

1.  Original  notes  of  FBI  & ICIG  meeting  held  on  July  22,  2015. 


Details : 


( //tUUU)  This  communication  servers  to  document  the  submission  of  a 
FD-340  (lA)  to  the  lA  sub-file  of  the  captioned  case  file. 


b6 

b7C 
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b7E 
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SEbWET  / /MOgORM 


Title : 
Re : 


m. 


^//MOFORM. 

The  Submission  of  FiD-34  0 


09/16/2015 


CLASSIFIED  NSICG  J76J1ST0O 

REASON;  1.4  <C) 

DECLASSir/  W 12-31-20*10 
DATE  11-03-2015 


ALL  IllFORliATION  COtlTAIWEE 
HEREIN  IS  TOC LASS IF ISE  EXCEPT 
IC4ERE  SHCTwl^  OTHERrfISE 


FD-10S7  (Rev.  5^840) 


/woroRW  I 

FEDERAL  BUREAU  OF  INVESTIGATION 

Eleotronlo  Communloation 


Title:  (U)  The  submission  of  FD-340 


Date:  09/16/2015 


CC: 


From:  WASHINGTON  FIELD 
WF-CI13 

Contact : 


^proved  By:  SSA 


Drafted  By: 


Case  ID  #; 


{s/m\  I 

MISHANDLING  OF  CLASSIFIED; 

UNKNOWN  SUBJECT  OR  COUNTRY; 

SENSITIVE  INVESTIGATIVE  MATTER  (SIM) 


Synopsis:  (U//TOUO)  To  document  the  submission  of  FD-340  (lA)  to  the 

lA  sub’-file  of  the  captioned  case  file. 


Full  Investigation  Initiated:  07/10/2015 


Reference : 


Serial 


18 


Enclosure (s) ; Enclosed  are  the  following  items: 
1 . ^^/NF)  Original  preservation  response  from 
on  July  31,  2015. 


Details : 


(U//FQUO)  This  communication  serves  to  document  the  submission  of 
FD-340  (lA)  to  the  lA  sub-file  of  the  captioned  case  file. 


b6 

b7C 


bl 

b3 

b7E 


b3 

b7E 


b7E 
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Title:  (U)  The  submission  of  FD-340 


Re: 


J 09/16/2015 


b3 

b7E 


/MO  J OR14 
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ALL  Il'irORi'^^TIDH  COliTAII^JED 

HERZIM  IS  ™CLASSIFIEC 

CATE  BY  J7€JiSTS0  N3ICG 


FD-302a(Rev.  10-6-95) 


-1- 

FEDERAL  BUREAU  OF  INVESTIGATION 


Date  of  transcription  09/15/2015 


On  September  14,  2015,  Patrick  F.  Kennedy,  the  Under  Secretary  of  State  for  Management,  U.S. 
Department  of  State,  Washington,  D.C.,  sent  an  LHM  to  FBI  Director  James  B.  Comey  regarding  the 
captioned  investigation. 


The  LHM  is  enclosed  in  the  attached  1 A. 


Investigation  on  09/15/2015 


at 


Washington,  DC 


This  document  contains  neither  recommendations  nor  conclusions  of  the  FBI.  It  is  the  property  of  the  FBI  and  is  loaned  to  your  agency;  it 
and  its  contents  are  not  to  be  distributed  outside  your  agency. 


FD^1057  (Rev,  5-S-lO) 


CLASSIFIED  BY:  IFSICG  J7^J1STS0 
BZASati:  1,4  {Z) 

DECLASSIFY/  DtT:  12-31-2040 
DATE : ll-05-20ie 


ALL  IigFORi.LATia'1  COWTAItiED 
HEREIN  IS  LTITCLASSIFIED  EXCEPT 
™EKZ  GTHERVaSE 


's^&Wfi^/MOPORM 


O FFICi AL  fiWb 


FEDERAL  BUREAU  OF  INVESTIGATION 


Eleotronlo  Com  mu  nictation 


Title:  (U//FQUQ)  The  submission  of  FD-340 


Date;  09/16/2015 


CC: 


b6 

b7C 


Prom:  WASHINGTON  FIELD 

WF-CI13 

Contact:  I 


Approved  By : SSA 


Drafted  By; 


■ Case  ID  # : 


MISHANDLING  OF  CLASSIFIED; 

UNKNOWN  SUBJECT  OR  COUNTRY; 

SENSITIVE  INVESTIGATIVE  MATTER  (SIM) 


Synopsis ; (U//roU9-)  To  document  the  submission  of  FD-34  0 to  the  lA 

sub-file  of  the  captioned  case  file. 


Full  Investigation  Initiated:  07/10/2015 


Reference ; 


Serial 


22 


iUi 


Enclosure (s) : Enclosed  are  the  following  items : 
1.  (^/1tF4  Original  notes  re  interview  of 

2015  I 


on  July  30. 


Details : 

(U//FQUQ)  This  communication  servers  to  document  the  submission  of  a 
FD-340  (lA)  to  the  lA  sub-file  of  the  captioned  case  file. 


hi 

b3 

b7E 


b3 

b7E 


b6 

b7C 


S6PK@  / /MOFORN 


s: 


7/iroroRW- 


Title:  (U//POUO)  The 

Re:  I 1 


submission 

09/16/2015 


of  FD-340 


b3 

b7E 
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FD-1057(Rev.  5-8-10) 
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isify  On:  20401231 

Details:  (U//-r0UO^  Former  Secretary  of  State  Hillary  Clint 
testified  before  the  United  States  House  of  Representatives 
Committee  on  Benghazi  on  10/22/15.  FBI  Attorney 


accessed  a transcript  of  the  testimony  via  the  Washington  p| 
or  about  10/22/15  and  emailed  the  document  to  Staff  Operat 


Specialist  (SOS) 


on  10/23/15.  A 


copy  of  the  verbatim  transcript  of  Clinton's  testimony  wil 
maintained  on  a CD  via  the  associated  lA. 


♦ ♦ 


S|3«f^//HOFORH 
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(Rev.  05-01-2008) 


CLASSIFIED  BY:  HSICG  JT^JISISD 
REASON:  1 . 4 iC) 


LASSIF^f  GIJ:  12-31-2041 


DATE : 11-09-201^ 


j;T//HOFOnN 

FEDERAL  BUREAU  OF  INVESTIGATION 


ALL  IHFORiEATIDH  COt'TTAIHEE 
BEKEIN  IS  UWCLASSIFIEE  EXCEPT 
VSERE  SHCi-JM  OTHERS  5E 


Precedence:  ROUTINE 


Date : 1/5/2016 


To:  Washington  Field 


From:  Washington  Field 


UNKNOWN  SUBJECT  OR  COUNTRY; 

SENSITIVE  INVESTIGATIVE  MATTER  (SIM) 

(Uj  Synopsis:  (X//-m  Provides  FBI  Washington  Field  Office  (WFO)  the 

conditional  authority  of  Original  Classifying  Authority  (OCA)  E.  W. 
Priestap,  Assistant  Director,  Counterintelligence  Division  (CD) , to 
show  SIDNEY  BLUMENTHAL,  and  his  legal  counsel,  an  email  sent  by 
BLUMENTHAL  that  has  since  been  deemed  to  contain  classified 
information. 


ated  20130301 


Details:  ^/ /-W^^)  This  communication . requests  the  conditional 

authority  or  Original  Classifying  Authority  (OCA)  E.  W.  Priestap, 
Assistant  Director,  Counterintelligence  Division  (CD) , to  show 
SIDNEY  BLUMENTHAL,  and  his  legal  counsel,  an  email  sent  by  BLUMENTHAL 
that  has  since  been  deemed  to  contain  classified  FBI*  information. 


iU)  For  background  informat ion ^ WFO  will  be  conducting  an 

interview  of  BLUMENTHAL  regarding  his  knowledge  of  matters  relevant 


b6 

b7C 


bl 

b3 

b7E 


t/Zhofobh 


-01-2008) 


T//WOFOPH 


FEDERAL  BUREAU  OF  INVESTIGATION 


to  the  captioned  investigation.  The  interview  will  be  conducted  on 
1/7/2016  and  will  also  be  attended  by  his  legal  counsel  from  Sidley 
Austin  LLP  and  attorneys  from  the  Department  of  Justice. 

/WF)  During  the  course  of  the  interview,  WFO  plans  to  show 
BLUMENTHAL  and  his  counsel  a copy  of  the  attached  email  that  he  sent 
on  April  23,  2010  to  the  former  Secretary  of  State,  Hillary  Clinton. 
Showing  the  email  to  BLUMENTHAL  and  his  counsel  will  allow  WFO  to 
pursue  a logical  line  of  questions  regarding  the  circumstances  in 
which  the  email  was  sent.  During  a recent  classification  review  the 
FBI  deemed  that  portions  of  the  email  contain  information  classified 
at  SECRET  level. 

) WFO  confirms  that  showing  the  email  will  not  result  in 
previous  unknown  sources  or  informants  being  revealed,  will  not 
negatively  impact  other  case  equities,  and  will  not  disclose 
information  from  any  other  agency  or  foreign  government. 

)>^//‘Wf^As  a result,  CD  provides  one-time  OCA  authority  for  FBI  WFO 
to  show  BLUMENTHAL  and  his  legal  counsel  the  email  above  during  its 
planned  interview. 

(X/Z'WfT  Prior  to  showing  BLUMENTHAL,  and  his  legal  counsel  the 
email,  BLUMENTHAL  and  his  legal  counsel  should  execute  a 
non-disclosure  agreement.  In  addition,  FBI  WFO  should  advise 
BLUMENTHAL  of  his  past  and  present  obligations  to  protect  classified 
information  including  the  contents  of  the  email.-.  FBI  WFO  will 
document  these  discussions  in  its  FD-302. 

Any  questions  or  concerns  regarding  this  matter  can  be  addressed 

to  saF”^  I 


♦ ♦ 


T//HOFORN 


FD-l087a(R(;v,  5-8-10) 


FBI  IHFG. 

CLASSIFIZE  BY:  3'ISICG  J75J1STS0 
REASCl’F  1.4  (C) 

DECLASSIFY  OF  r 12-31-20  41 
CATE:  11-03-2016 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Evidence  Entry 


b7E 


Event  Title : 


(S) 


Date:  01/08/2016 


Approved  By; 


Drafted  By: 


b6 

b7C 


Case  ID  #; 


I I 

MISHANDLING  OF  CLASSIFIED; 

UNKNOWN  SUBJECT  OR  COUNTRY; 

SENSITIVE  INVESTIGATIVE  MATTER  (SIM) 


bl 

b3 

b7E 


Collected  By:  Missing  on  Missing 


Collected  From:  Department  of  State 

Receipt  Given? : No 

Holding  Office:  WASHINGTON  FIELD 


Item  Type 

IB  Digital 


Description 

(Uj  1 Thumb  Drive  with  Green  Unclassified  Sticker  On 

It 

Collected  On:  01/07/201  6 

Seizing  Individual : 

Located  By: 

Location  Area:  NA 
Specific  Location:  Na 

Device  Type:  USB  Micro  Storage  Device  {thumb  drive) 
Number  of  Devices  Collected:  1 


b6 

b7C 


SEjaftET  / /TOPOTOT 


SEpK^/  /MQPOIW 


Title:  (S) 

bl 

b3 

b7E 

Re: 

01/08/2016 

IB  Digital 

1 Thumb  Drive  with  Red  Secret  Sticker  On  It 

Collected  On;  01/07/2016 

. . r — 

Seizing  Individual : 1 

b6 

Located  By; 

Location  Area;  WA 
Specific  Location : NA 

Device  Type;  USB  Micro  Storage  Device  [thumb  drive) 
Humber  of  Devices  Collected:  1 


bVC 
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